Supply chain · npm · High

Critical: Malicious 'svelte-streak-metrics' npm Package Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-23

A malicious npm package, 'svelte-streak-metrics', has been identified as capable of fully compromising any system where it is installed or run. This poses a critical supply-chain risk, necessitating immediate action to rotate credentials and remediate affected systems.

  • Package: npm / svelte-streak-metrics
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The 'svelte-streak-metrics' npm package contains malware. Installation or execution of this package leads to a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly benign software component is introduced into a development or production environment. Upon installation or execution, the embedded malware activates, establishing unauthorized access and control over the host system, typically for credential or secret theft.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unvetted or latest package versions
  • Any user or system that has directly or indirectly installed 'svelte-streak-metrics'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing for installation of malicious versions
  • Lack of package-lock.json or similar lockfiles to ensure consistent dependency resolution
  • Use of internal package mirrors that do not vet upstream packages
  • Automated builds or deployments that do not scan new dependencies for known threats

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets, keys, and sensitive data stored on the compromised computer are at risk of theft.
  • The integrity of development environments, build artifacts, and deployed applications can be severely undermined.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of 'svelte-streak-metrics' in any version.
  • Review package-lock.json or yarn.lock files for unexpected entries or modifications.
  • Monitor network traffic for unusual outbound connections from systems that might have installed this package.

Contain

  • Immediately isolate any system identified as having 'svelte-streak-metrics' installed.
  • Block network access for compromised systems to prevent further communication with external adversaries.
  • Suspend any CI/CD pipelines or automated processes that could install this package.

Remediate

  • Consider any system that installed 'svelte-streak-metrics' to be fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from the compromised computer, performing this action from a different, trusted machine.
  • Remove the 'svelte-streak-metrics' package from all environments, but acknowledge that removal alone may not eliminate all malicious components due to the nature of full system compromise.

Frontier verdict — High

Prioritize immediate detection and remediation of 'svelte-streak-metrics' due to critical system compromise and credential theft risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.