Supply chain · npm · High

Critical npm package '@fongsidev/scraper' leads to full system compromise

Threat Engine Auto-Feed · data current as of 2026-08-26

The npm package '@fongsidev/scraper' has been identified as malicious, leading to full system compromise upon installation. All systems that have installed or run this package should be considered compromised, necessitating immediate secret rotation and thorough remediation.

  • Package: npm / @fongsidev/scraper
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package '@fongsidev/scraper' contains malware. Installation or execution of this package results in a complete compromise of the host system. The advisory indicates that an outside entity may gain full control of the affected computer.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the embedded malware executes, establishing unauthorized access and control over the host system, potentially exfiltrating sensitive data or installing further malicious software.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed '@fongsidev/scraper'

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to malicious versions
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Internal package mirrors that do not vet upstream packages
  • Automated build processes that install new or updated dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets and keys stored on the compromised computer are exposed and can be used by the attacker.
  • The integrity of the development environment or production system is severely compromised, requiring extensive recovery efforts.

What to do (defensive)

Detect

  • Identify all systems where '@fongsidev/scraper' has been installed or run.
  • Review dependency trees for all projects to check for direct or transitive inclusion of '@fongsidev/scraper'.

Contain

  • Immediately isolate any identified compromised systems from the network.
  • Stop all processes related to '@fongsidev/scraper' and any applications that depend on it.

Remediate

  • Consider all secrets and keys stored on compromised systems to be compromised and rotate them immediately from a different, trusted computer.
  • Remove the '@fongsidev/scraper' package from all affected systems, though this alone may not remove all malicious software.
  • Perform a full forensic analysis and re-imaging of compromised systems, as full control may have been ceded to an attacker.
  • Implement strict dependency management practices, including pinning versions and using lockfiles, to prevent similar incidents.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and system re-imaging due to full system control by an attacker.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.