Supply chain · npm · High

Critical Malware in npm Package @a23842/dsh-notifier

Threat Engine Auto-Feed · data current as of 2026-09-03

A critical vulnerability has been identified in the npm package `@a23842/dsh-notifier`, which is categorized as malware. Installation of this package leads to full system compromise, necessitating immediate secret rotation and system remediation.

  • Package: npm / @a23842/dsh-notifier
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@a23842/dsh-notifier` has been identified as malicious software. Any system that has installed or executed this package should be considered fully compromised.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a software ecosystem. When developers or automated systems install this package, it executes code that compromises the host system, potentially leading to credential or secret theft.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package dependencies
  • Developers who directly installed `@a23842/dsh-notifier`

Conditions that increase exposure

  • Unpinned or broad dependency versions (e.g., `*`, `latest`)
  • Lack of dependency lockfiles in projects
  • Use of internal package mirrors that do not vet upstream packages
  • Automated build processes that install new dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised computer, potentially accessing and exfiltrating all stored secrets and keys.
  • The blast radius extends to any system that has interacted with or built artifacts from the compromised machine, as well as any credentials used on that machine.

What to do (defensive)

Detect

  • Scan dependency trees for `@a23842/dsh-notifier` in all projects.
  • Monitor network traffic for unusual outbound connections from systems that may have installed the package.
  • Review system logs for unexpected process execution or file modifications on developer workstations and build servers.

Contain

  • Immediately isolate any system identified as having installed `@a23842/dsh-notifier` from the network.
  • Suspend all CI/CD pipelines and development activities that might pull this package.
  • Block `@a23842/dsh-notifier` from being downloaded via package managers or internal registries.

Remediate

  • Consider any compromised computer as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys that were stored on or accessible from the compromised computer, performing this action from a different, trusted machine.
  • Remove the `@a23842/dsh-notifier` package, understanding that this alone may not remove all malicious software.

Frontier verdict — High

Prioritize immediate investigation and remediation for any system that has installed the malicious npm package `@a23842/dsh-notifier` due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.