Supply chain · npm · High

Critical Malicious npm Package 'mc-provider' Poses Full System Compromise Risk

Threat Engine Auto-Feed · data current as of 2026-08-25

The npm package 'mc-provider' has been identified as malicious, leading to full system compromise upon installation. This poses a critical supply-chain risk, requiring immediate action to rotate credentials and remediate affected systems.

  • Package: npm / mc-provider
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~210/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'mc-provider' contains malware. Installation or execution of this package results in a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the malicious code executes, establishing unauthorized access and control over the compromised system, typically to exfiltrate sensitive data or maintain persistence.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any user or system that has 'mc-provider' as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned dependency versions in package.json (e.g., using '*' or '^')
  • Lack of package-lock.json or yarn.lock files to ensure deterministic builds
  • Internal package mirrors that do not vet upstream dependencies
  • Automated build processes that do not scan new dependencies for known vulnerabilities or malicious behavior

Blast-radius scenarios

  • An attacker gains full control over the compromised computer, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets and keys stored on the compromised system are at risk of theft, necessitating immediate rotation.
  • The integrity of development environments, build servers, and production systems could be severely compromised.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of 'mc-provider' in any version.
  • Review package-lock.json or yarn.lock files for 'mc-provider'.
  • Monitor network traffic for unusual outbound connections from systems that installed new npm packages.

Contain

  • Immediately isolate any system identified as having installed 'mc-provider'.
  • Prevent further installations of 'mc-provider' by blocking the package in internal registries or firewalls.
  • Suspend any CI/CD pipelines that might pull this package.

Remediate

  • Consider any system that installed 'mc-provider' to be fully compromised.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from the compromised computer. This rotation must be performed from a different, trusted system.
  • Remove the 'mc-provider' package. However, due to the nature of full compromise, a complete system rebuild or restoration from a known clean backup is strongly recommended to ensure all malicious components are eradicated.

Frontier verdict — High

This is a critical priority due to full system compromise and credential theft, requiring immediate isolation, secret rotation, and system remediation.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.