Supply chain · npm · High

Malicious npm package 'ida-gado-gado74-sukiwir' pollutes registry, alters package metadata

Threat Engine Auto-Feed · data current as of 2026-09-13

The npm package 'ida-gado-gado74-sukiwir' contains malicious code designed to modify `package.json` files, remove private flags, alter version numbers, and continuously republish variants with randomized names. This activity aims to inflate developer reputation scores within a specific token reward campaign, leading to registry pollution and potential integrity risks for projects that install it.

  • Package: npm / ida-gado-gado74-sukiwir
  • Affected versions: > 0
  • Severity: critical
  • Reach: ~1/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'ida-gado-gado74-sukiwir' was identified as containing malicious code. This code manipulates project metadata by removing private flags from `package.json`, changing version numbers, and generating new, randomized package names. Its primary function appears to be the automated generation and publication of derivative packages to the npm registry.

How the attack works

This attack leverages automated scripts within the package to modify local project configuration files, specifically `package.json`. Upon execution, these scripts alter critical metadata, then proceed to publish new, similarly named packages. This type of automated publishing can lead to a proliferation of unwanted packages, impacting registry integrity and potentially introducing unexpected dependencies into build environments.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines configured to pull unpinned or latest versions of dependencies
  • Organizations that mirror public npm registries without thorough vetting

Conditions that increase exposure

  • Projects with unpinned dependencies that could inadvertently pull the malicious package or its variants
  • Lack of `package-lock.json` or `npm-shrinkwrap.json` to ensure deterministic dependency resolution
  • Automated build processes that do not validate package integrity before installation

Blast-radius scenarios

  • An attacker can achieve modification of project `package.json` files, potentially exposing sensitive project configurations.
  • The continuous republishing of variants pollutes the npm registry, making it harder to distinguish legitimate packages from malicious ones.
  • Installation of this package could lead to unexpected changes in project metadata and an increased attack surface if the modified `package.json` is committed or used in further build steps.

What to do (defensive)

Detect

  • Scan `package.json` files for unexpected modifications, especially the removal of 'private' flags or changes to version numbers.
  • Monitor network traffic for outbound connections to package registries that are not part of standard build processes.
  • Review `npm install` logs for warnings or errors related to package publishing or unexpected script execution.

Contain

  • Isolate any development or build environments where 'ida-gado-gado74-sukiwir' or its variants may have been installed.
  • Block the malicious package and its known variants at the registry or proxy level.
  • Implement strict package integrity checks and require `package-lock.json` for all projects to prevent non-deterministic dependency resolution.

Remediate

  • Remove 'ida-gado-gado74-sukiwir' and any derivative packages from all project dependencies.
  • Revert `package.json` files to known good states from version control.
  • Audit all affected systems for any further unauthorized modifications or deployed artifacts.

Frontier verdict — High

Prioritize immediate removal of 'ida-gado-gado74-sukiwir' and its variants due to critical severity and registry pollution risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.