Supply chain · npm · High

Critical Malware in npm Package @inpeek/odata-angular

Threat Engine Auto-Feed · data current as of 2026-10-05

A critical malware package, `@inpeek/odata-angular` (version 99.99.99), has been identified in the npm ecosystem. Installation of this package leads to full system compromise, necessitating immediate action to secure affected systems and rotate credentials.

  • Package: npm / @inpeek/odata-angular
  • Affected versions: = 99.99.99
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@inpeek/odata-angular` version 99.99.99 contains malware. Any system that has installed or run this specific version of the package should be considered fully compromised.

How the attack works

This is a malicious package injection, a type of supply-chain attack where a seemingly legitimate software component is tampered with to include harmful code. When integrated into a project, the malicious code executes, potentially granting an attacker unauthorized access or control over the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations whose CI/CD pipelines pull unpinned or latest versions of dependencies
  • Any user or system that has directly or indirectly installed `@inpeek/odata-angular` version 99.99.99

Conditions that increase exposure

  • Projects with unpinned dependencies that could resolve to the malicious version
  • Lack of `package-lock.json` or similar lockfiles to ensure deterministic builds
  • Reliance on internal package mirrors that may not filter out malicious versions
  • Automated build systems that do not perform dependency integrity checks

Blast-radius scenarios

  • An attacker gains full control over the compromised computer, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets and keys stored on the compromised system are exposed and can be used by the attacker.
  • The integrity of development environments and build pipelines is compromised, potentially leading to further supply chain attacks.

What to do (defensive)

Detect

  • Scan project dependencies for `@inpeek/odata-angular` version 99.99.99.
  • Review build logs and dependency trees for unexpected package installations.
  • Monitor network traffic for unusual outbound connections from development or build systems.

Contain

  • Immediately isolate any system identified as having installed `@inpeek/odata-angular` version 99.99.99.
  • Block network access for compromised systems to prevent further communication with attacker infrastructure.
  • Suspend any CI/CD pipelines that may be pulling this dependency.

Remediate

  • Consider any system that installed the package to be fully compromised and rebuild from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Remove the malicious package from all affected projects and ensure dependency pinning is in place to prevent re-introduction.
  • Implement strict dependency integrity checks and review processes for all third-party packages.

Frontier verdict — High

This is a critical severity supply-chain compromise requiring immediate isolation, credential rotation, and system rebuilds due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.