Supply chain · npm · High

Critical npm Package 'real-browser-plus' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-30

The npm package 'real-browser-plus' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / real-browser-plus
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~136/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'real-browser-plus' npm package contains malware that, once installed, fully compromises the host system. This grants an external entity complete control over the compromised computer.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is distributed with hidden harmful code. When integrated into a project and installed, the malicious code executes, establishing unauthorized access and control over the system.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines configured to pull the latest versions of dependencies
  • Any organization with projects directly or indirectly depending on 'real-browser-plus'

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to malicious versions
  • Lack of dependency lockfiles (e.g., package-lock.json) in projects
  • Use of internal package mirrors that do not vet upstream packages

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets, API keys, and credentials stored on the compromised machine are exposed and can be stolen and misused.
  • The blast radius extends to any systems that interact with the compromised machine or use its exposed credentials.

What to do (defensive)

Detect

  • Scan dependency trees for 'real-browser-plus' across all projects.
  • Monitor network traffic for unusual outbound connections from development or build systems.
  • Review system logs for unauthorized process execution or file modifications.

Contain

  • Immediately isolate any system found to have 'real-browser-plus' installed.
  • Block 'real-browser-plus' from being downloaded or installed from package registries.
  • Suspend any CI/CD pipelines that might be pulling this package.

Remediate

  • Consider any system that installed 'real-browser-plus' fully compromised; re-image or rebuild from a trusted state.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Remove 'real-browser-plus' from all project dependencies and ensure lockfiles are updated to prevent reintroduction.

Frontier verdict — High

Prioritize immediate action due to critical severity and full system compromise potential from 'real-browser-plus'.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.