Supply chain · npm · High

Critical npm package 'amplitude-ma-ts' identified as malware, leading to full compromise

Threat Engine Auto-Feed · data current as of 2026-08-14

A critical malicious package, 'amplitude-ma-ts' (version 1.0.21), has been identified in the npm ecosystem. Its installation leads to full system compromise, necessitating immediate secret rotation and thorough remediation to mitigate severe credential/secret theft risks.

  • Package: npm / amplitude-ma-ts
  • Affected versions: = 1.0.21
  • Severity: critical
  • Reach: ~266/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'amplitude-ma-ts' version 1.0.21 has been flagged as malware. Any system where this specific version of the package is installed or executed should be considered fully compromised.

How the attack works

This is a supply-chain attack where a malicious software package is introduced into a public registry. When developers integrate this package into their projects, the malicious code is executed during installation or runtime, leading to unauthorized access and control over the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'amplitude-ma-ts' version 1.0.21

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to vulnerable versions
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock)
  • Use of internal package mirrors that replicate public registry vulnerabilities
  • Automated build processes that do not vet new package versions

Blast-radius scenarios

  • An attacker gains full control over the compromised computer, potentially leading to data exfiltration, further network penetration, or deployment of additional malicious software.
  • All secrets and keys stored on the compromised system are exposed and can be stolen, enabling credential/secret theft.
  • The integrity of development environments and production systems is severely compromised, requiring extensive recovery efforts.

What to do (defensive)

Detect

  • Audit package.json and package-lock.json files for 'amplitude-ma-ts' version 1.0.21.
  • Scan dependency trees of all npm projects for the presence of the malicious package.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Isolate any system identified with 'amplitude-ma-ts' version 1.0.21 immediately from the network.
  • Suspend all CI/CD pipelines that could potentially install this package.
  • Block 'amplitude-ma-ts' version 1.0.21 at your network perimeter and package registry.

Remediate

  • Consider all secrets and keys stored on compromised systems to be compromised; rotate them immediately from a different, trusted computer.
  • Remove the 'amplitude-ma-ts' package from all affected systems. However, be aware that full control may have been given to an attacker, so removal alone does not guarantee complete eradication of malicious software.
  • Perform a full forensic analysis and rebuild compromised systems from trusted backups to ensure complete removal of any persistent threats.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate action due to full system compromise and credential/secret theft risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.