Supply chain · npm · High

Critical Malicious 'scan-only' npm Package Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-17

A critical malicious npm package, 'scan-only', has been identified. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation due to potential persistent access by attackers.

  • Package: npm / scan-only
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~800/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'scan-only' npm package contains malware that, upon installation, fully compromises the host computer. This grants an external entity complete control over the system.

How the attack works

This is a malicious package attack where a seemingly benign or useful software component is injected with harmful code. When integrated into a project and installed, the malicious code executes, establishing unauthorized access and control over the system it runs on.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that install npm dependencies
  • Any system where 'scan-only' was installed directly or as a transitive dependency

Conditions that increase exposure

  • Projects with unpinned dependencies that automatically pull the latest versions
  • Environments lacking strict dependency lockfiles (e.g., package-lock.json)
  • Internal package mirrors that have synchronized the malicious package

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets, keys, and sensitive data on the compromised system are exposed and potentially exfiltrated.
  • The compromised system can be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Review package-lock.json or yarn.lock files for 'scan-only' as a direct or transitive dependency.
  • Scan build artifacts and deployed environments for the presence of the 'scan-only' package.
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages.

Contain

  • Immediately isolate any system identified as having installed 'scan-only'.
  • Block 'scan-only' from being pulled from npm registries or internal mirrors.
  • Suspend CI/CD pipelines that might be installing this package.

Remediate

  • Consider any system that installed 'scan-only' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, using a different, trusted computer.
  • Perform a thorough forensic analysis to understand the extent of the compromise and identify any persistence mechanisms.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and system rebuild due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.