Supply chain · npm · High

Critical Supply-Chain Alert: Malicious 'typescript-util-core' npm Package

Threat Engine Auto-Feed · data current as of 2026-07-03

The npm package 'typescript-util-core' has been identified as malicious, leading to full system compromise upon installation. This poses a critical threat to development environments and build systems that have integrated this package, necessitating immediate action to prevent credential and secret theft.

  • Package: npm / typescript-util-core
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~265/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'typescript-util-core' npm package contains malware. Any system where this package has been installed or executed should be considered fully compromised, with potential for an outside entity to gain full control.

How the attack works

This is a malicious package attack where a seemingly benign software component, when integrated into a project, executes unauthorized code. This typically involves the package's installation script or main logic performing actions beyond its stated purpose, such as exfiltrating sensitive data or establishing persistent access.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any developer or system administrator who has installed 'typescript-util-core' directly or indirectly

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing arbitrary version updates
  • Lack of package-lock.json or yarn.lock files to ensure consistent dependency resolution
  • Use of internal package mirrors that do not vet upstream packages for malicious content

Blast-radius scenarios

  • An attacker gains full control of the compromised system, potentially leading to credential and secret theft.
  • Sensitive data stored on the compromised computer, such as API keys, tokens, or source code, may be exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the organization's network.

What to do (defensive)

Detect

  • Scan project dependency trees for 'typescript-util-core' using `npm list typescript-util-core` or similar tools.
  • Review CI/CD logs and build artifacts for evidence of 'typescript-util-core' installation.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system identified as having 'typescript-util-core' installed from the network.
  • Suspend any CI/CD pipelines or automated processes that could install new dependencies until a review is complete.
  • Block 'typescript-util-core' at the network perimeter or within internal package registries to prevent further downloads.

Remediate

  • Consider any system that installed 'typescript-util-core' to be fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, access tokens) that were stored on or accessible from the compromised computer, using a different, uncompromised system.
  • Thoroughly audit all code repositories for unauthorized changes or injected malicious code, especially those built on compromised systems.

Frontier verdict — High

Prioritize immediate detection and remediation of 'typescript-util-core' due to critical system compromise and credential theft risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.