Supply chain · npm · High

Critical npm Package 'captchetat-angularv8' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-10-06

A critical malicious npm package, 'captchetat-angularv8', has been identified as malware. Any system where this package was installed should be considered fully compromised, necessitating immediate secret rotation and thorough remediation efforts.

  • Package: npm / captchetat-angularv8
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~435/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'captchetat-angularv8' has been identified as malware. Installation of this package leads to a full compromise of the host system, allowing for credential and secret theft.

How the attack works

This attack involves a malicious software package distributed through a public registry. When installed, it executes code that compromises the host system, enabling unauthorized access and exfiltration of sensitive information such as credentials and secrets.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines configured to pull the latest versions of dependencies
  • Organizations with internal mirrors that have synced this package

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing for arbitrary version updates
  • Lack of package-lock.json or yarn.lock files to ensure deterministic builds
  • Automated build processes that do not vet new package versions

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to further network penetration.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen.
  • The compromised system could be used as a pivot point for lateral movement within an organization's network.

What to do (defensive)

Detect

  • Scan dependency trees for 'captchetat-angularv8' in all projects.
  • Review package-lock.json or yarn.lock files for unexpected entries.
  • Monitor network traffic for unusual outbound connections from development or build systems.

Contain

  • Immediately isolate any system found to have 'captchetat-angularv8' installed.
  • Block 'captchetat-angularv8' from being downloaded from package registries or internal mirrors.
  • Temporarily halt builds that pull dependencies from public npm registries until a review is complete.

Remediate

  • Consider any system that installed 'captchetat-angularv8' fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (API keys, SSH keys, access tokens) that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Remove the 'captchetat-angularv8' package, but acknowledge that this alone may not remove all malicious components due to potential full system compromise.

Frontier verdict — High

This is a critical priority due to full system compromise and credential theft, requiring immediate isolation and secret rotation.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.