Supply chain · npm · High

Critical Malware in npm Package @ikyyjee/ikkysingle Poses Full System Compromise Risk

Threat Engine Auto-Feed · data current as of 2026-10-07

A critical vulnerability has been identified in the npm package `@ikyyjee/ikkysingle`, which, if installed, leads to full system compromise. Organizations using this package should consider affected systems fully compromised and prioritize immediate remediation to prevent credential theft and further malicious activity.

  • Package: npm / @ikyyjee/ikkysingle
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@ikyyjee/ikkysingle` contains malware. Installation or execution of this package results in the complete compromise of the host system. The advisory explicitly states that all secrets and keys on the compromised computer should be rotated.

How the attack works

This is a malicious package attack where an adversary publishes a seemingly legitimate or dependency-like package containing harmful code. When developers integrate this package into their projects, the malicious code is executed during installation or runtime, allowing the attacker to gain unauthorized access and control over the system where the package is installed.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations whose CI/CD pipelines pull npm dependencies
  • Any user or system that has installed or run `@ikyyjee/ikkysingle`

Conditions that increase exposure

  • Projects with unpinned dependencies that might inadvertently pull the malicious package
  • Lack of dependency lockfiles (e.g., `package-lock.json`)
  • Use of internal package mirrors that do not vet upstream packages
  • Automated build systems that install dependencies without manual review

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets, API keys, and credentials stored on the system are exposed and can be exfiltrated.
  • The compromised system can be used as a pivot point for further network intrusion.
  • Sensitive intellectual property or data on the system can be accessed and stolen.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of `@ikyyjee/ikkysingle` in `package.json` or `package-lock.json` files.
  • Review build logs and package installation histories for evidence of `@ikyyjee/ikkysingle` being pulled.
  • Monitor network traffic from development machines and CI/CD environments for unusual outbound connections.

Contain

  • Immediately isolate any systems identified as having installed or run `@ikyyjee/ikkysingle` from the network.
  • Suspend all CI/CD pipelines that might be installing this package.
  • Block `@ikyyjee/ikkysingle` at the network perimeter and in internal package registries to prevent further ingress.

Remediate

  • Consider any computer that installed `@ikyyjee/ikkysingle` to be fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised computer, using a different, uncompromised system.
  • Remove the `@ikyyjee/ikkysingle` package from all projects and ensure dependency manifests are updated to prevent re-introduction.
  • Implement strict dependency pinning and review processes for all third-party packages.

Frontier verdict — High

This is a critical severity supply-chain compromise requiring immediate isolation, credential rotation, and system rebuilds due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.