Supply chain · npm · High

Critical npm Package 'auth-next-gen' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-11

The npm package 'auth-next-gen' has been identified as malicious, leading to full system compromise upon installation. This poses a critical supply-chain risk, necessitating immediate action to protect secrets and systems.

  • Package: npm / auth-next-gen
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~344/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'auth-next-gen' npm package contains malware. Installation of this package results in a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the malicious code executes, establishing unauthorized access and control over the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any system or developer workstation where 'auth-next-gen' was installed

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing automatic updates to malicious versions
  • Lack of package-lock.json or yarn.lock to ensure consistent dependency resolution
  • Use of internal package mirrors that do not vet upstream packages
  • Automated builds that install dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen by the attacker.
  • The integrity of software built on the compromised system may be compromised, leading to downstream supply chain risks.

What to do (defensive)

Detect

  • Scan project dependencies for 'auth-next-gen' using dependency analysis tools.
  • Review package-lock.json or yarn.lock files for the presence of 'auth-next-gen'.
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages.

Contain

  • Immediately isolate any system identified with 'auth-next-gen' installed from the network.
  • Suspend any CI/CD pipelines that may have installed or built with 'auth-next-gen'.
  • Block 'auth-next-gen' from being downloaded or installed from package registries.

Remediate

  • Consider any system that installed 'auth-next-gen' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on the compromised computer, performing this action from a different, uncompromised system.
  • Remove the 'auth-next-gen' package from all projects and ensure it is not reintroduced.

Frontier verdict — High

Prioritize immediate investigation and remediation for any system that installed 'auth-next-gen' due to critical system compromise and credential theft risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.