Supply chain · npm · High

Critical npm Package 'poly-kelly' Compromises Systems for Credential Theft

Threat Engine Auto-Feed · data current as of 2026-07-29

The npm package 'poly-kelly' has been identified as malicious, leading to full system compromise upon installation. This directly exposes all secrets and keys on affected machines, necessitating immediate rotation and thorough remediation.

  • Package: npm / poly-kelly
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~84/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'poly-kelly' contains malware. Installation or execution of this package results in the complete compromise of the host computer, allowing an external entity to gain full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a system. Upon installation, the malware executes, establishing unauthorized access and control over the compromised machine, typically to exfiltrate sensitive data or maintain persistence.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that pull npm packages
  • Any system where 'poly-kelly' was directly or indirectly installed

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest malicious version
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent builds
  • Internal package mirrors that have not been updated to block the malicious package

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the affected computer are exposed and potentially exfiltrated.
  • The blast radius extends to any systems that interact with the compromised machine, potentially leading to further lateral movement or data breaches.

What to do (defensive)

Detect

  • Scan package dependency trees for 'poly-kelly'.
  • Review system logs for unusual network activity or process execution on machines that installed npm packages around the publication date (2026-07-29).

Contain

  • Immediately isolate any systems identified with 'poly-kelly' installed.
  • Block 'poly-kelly' from being downloaded or installed from internal package registries and firewalls.

Remediate

  • Consider any computer with 'poly-kelly' installed as fully compromised and rebuild from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, access tokens) from a different, uncompromised computer.
  • Remove the 'poly-kelly' package, but acknowledge that full remediation may require more extensive system cleanup due to potential persistence mechanisms.

Frontier verdict — High

Prioritize immediate action due to critical severity and full system compromise, requiring secret rotation and system rebuilds.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.