Supply chain · npm · High

Critical Supply-Chain Alert: Malicious npm Package @usemosaik/template-react-js

Threat Engine Auto-Feed · data current as of 2026-09-08

A malicious version of the npm package `@usemosaik/template-react-js` has been identified. Installation of this package leads to full system compromise, necessitating immediate secret rotation and system remediation due to potential credential theft.

  • Package: npm / @usemosaik/template-react-js
  • Affected versions: = 1.0.1
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@usemosaik/template-react-js` version 1.0.1 contains malware. Any system that installed or ran this specific version should be considered fully compromised.

How the attack works

This is a supply-chain attack where a legitimate-looking software package is trojanized with malicious code. When installed, the package executes its harmful payload, granting an attacker unauthorized access and control over the compromised system, likely leading to credential or secret theft.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that directly or indirectly installed `@usemosaik/template-react-js` version 1.0.1

Conditions that increase exposure

  • Unpinned dependencies in `package.json` allowing automatic updates to vulnerable versions
  • Lack of `package-lock.json` or equivalent lockfiles to ensure consistent dependency resolution
  • Use of internal package mirrors that may not have been updated to block the malicious version

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The blast radius extends to any systems or services accessible from the compromised host, potentially leading to further lateral movement or data breaches.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for `@usemosaik/template-react-js` version 1.0.1.
  • Review build logs and dependency installation histories for evidence of the package being pulled.
  • Monitor network traffic for unusual outbound connections from systems that may have installed the package.

Contain

  • Immediately isolate any systems identified as having installed `@usemosaik/template-react-js` version 1.0.1.
  • Block the malicious package version at your package registry or proxy to prevent further installations.
  • Suspend any CI/CD pipelines that could potentially install this package.

Remediate

  • Consider any compromised system as fully compromised; re-image or rebuild from a trusted source.
  • Rotate all secrets and keys (API keys, credentials, tokens, SSH keys) that were stored on or accessible from the compromised computer, performing this action from a different, trusted system.
  • Remove the malicious package, but acknowledge that this alone may not fully remove all malicious software.

Frontier verdict — High

This is a critical severity supply-chain compromise requiring immediate isolation, secret rotation, and system remediation due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.