Supply chain · npm · High

CRITICAL: Malicious npm package @sql-trigger/nodesql leads to full system compromise

Threat Engine Auto-Feed · data current as of 2026-07-05

The npm package `@sql-trigger/nodesql` has been identified as malicious, leading to full compromise of any system where it is installed or run. This poses a critical supply-chain risk, necessitating immediate action to rotate credentials and remediate affected systems.

  • Package: npm / @sql-trigger/nodesql
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

A malicious version of the npm package `@sql-trigger/nodesql` was published. Installation or execution of this package results in a complete compromise of the host system. The advisory explicitly states that all secrets and keys on such a system should be considered compromised.

How the attack works

This is a malicious package attack, where a seemingly legitimate software component is weaponized to execute unauthorized actions upon installation or use. In this instance, the package grants an external entity full control over the compromised computer, indicating potential for remote code execution and data exfiltration.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull npm dependencies
  • Any system administrator or developer who directly installed or ran `@sql-trigger/nodesql`

Conditions that increase exposure

  • Unpinned dependencies in `package.json` that could pull the malicious version
  • Lack of `package-lock.json` or similar lockfiles to ensure consistent dependency versions
  • Use of internal npm mirrors that have not been updated to block the malicious package
  • Automated build processes that install dependencies without manual review

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets, keys, and sensitive data stored on the compromised system are exposed and potentially exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan dependency trees for `@sql-trigger/nodesql` in any version.
  • Review build logs and package installation histories for evidence of `@sql-trigger/nodesql` being pulled.
  • Monitor network traffic for unusual outbound connections from systems that might have installed this package.

Contain

  • Immediately isolate any system identified as having installed or run `@sql-trigger/nodesql`.
  • Block `@sql-trigger/nodesql` from being downloaded or installed from all package registries and mirrors.
  • Suspend any automated builds or deployments that could pull new dependencies until the package is blocked.

Remediate

  • Consider any system that installed or ran `@sql-trigger/nodesql` to be fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, database credentials) that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Perform a thorough forensic analysis on affected systems to understand the full extent of the compromise, if resources allow.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, credential rotation, and system remediation due to full system takeover.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.