Supply chain · npm · Critical

Critical npm Package 'nolimit-agent' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-13

The npm package 'nolimit-agent' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / nolimit-agent
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~4,045/wk
  • Exposure: 80/100 (Critical)

What happened — Credential / secret theft

The 'nolimit-agent' npm package contains malware that, when installed, fully compromises the host system. This grants an external entity control over the affected computer.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a software ecosystem. When developers or automated systems integrate this package into their projects, the embedded malware executes, compromising the system it runs on. The specific mechanism involves credential and secret theft.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package updates
  • Any user or system that has installed 'nolimit-agent'

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to malicious versions
  • Lack of package lockfiles to ensure consistent dependency versions
  • Internal package mirrors that may not vet packages for malicious content

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or deployment of additional malicious software.
  • All secrets and keys (e.g., API tokens, SSH keys, cloud credentials) stored on the compromised machine are exposed and can be stolen.
  • The blast radius extends to any systems that interact with the compromised machine or use its exposed credentials.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of 'nolimit-agent'.
  • Monitor network traffic for unusual outbound connections from systems that installed this package.
  • Review system logs for unexpected process execution or file modifications post-installation.

Contain

  • Immediately isolate any system identified with 'nolimit-agent' installed from the network.
  • Block 'nolimit-agent' from being downloaded or installed in your environment.
  • Suspend any automated builds or deployments that might pull this package.

Remediate

  • Consider any system that installed 'nolimit-agent' as fully compromised and rebuild from a trusted image.
  • Rotate all secrets, keys, and credentials that were stored on or accessible from the compromised system, using a different, uncompromised machine.
  • Remove the 'nolimit-agent' package, but acknowledge that this alone may not fully remove all malicious components due to potential persistent compromise.

Frontier verdict — Critical

This is a critical severity supply-chain compromise requiring immediate isolation, credential rotation, and system rebuilds for any affected npm environment.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.