Supply chain · npm · High

Critical npm package 'is-generator-check' compromises systems, rotate all secrets

Threat Engine Auto-Feed · data current as of 2026-09-02

The npm package 'is-generator-check' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately from a separate, secure machine, and the package removed.

  • Package: npm / is-generator-check
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~136/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'is-generator-check' npm package contains malware. Any system where this package has been installed or run should be considered fully compromised.

How the attack works

This is a malicious package attack where a seemingly innocuous library introduces harmful code into a development or production environment. Upon installation, the malicious code executes, potentially granting an attacker unauthorized access and control over the compromised system, enabling credential and secret theft.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that build npm projects
  • Any team whose applications depend on 'is-generator-check'

Conditions that increase exposure

  • Unpinned dependencies that automatically pull the latest versions
  • Lack of package-lock.json or similar lockfiles
  • Use of internal package mirrors that cache malicious versions
  • Direct or transitive dependency on 'is-generator-check'

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the affected system are exposed and potentially exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Identify all projects and environments that have 'is-generator-check' installed as a direct or transitive dependency.
  • Scan package-lock.json or yarn.lock files for the presence of 'is-generator-check'.

Contain

  • Immediately isolate any systems identified as having installed or run 'is-generator-check'.
  • Block network egress from compromised systems to prevent data exfiltration and command-and-control communication.

Remediate

  • Consider all secrets and keys on compromised systems to be compromised; rotate them immediately from a different, secure computer.
  • Remove the 'is-generator-check' package from all affected environments.
  • Rebuild compromised systems from trusted images, as removing the package alone may not eliminate all malicious software.
  • Update dependency management practices to pin versions and use lockfiles to prevent automatic installation of malicious updates.

Frontier verdict — High

This is a critical severity incident requiring immediate action to isolate systems and rotate all affected credentials due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.