Supply chain · npm · High

CRITICAL: Malicious 'authvaultx' npm Package Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-11

A critical malicious package, 'authvaultx', has been identified in the npm ecosystem. Its installation leads to full system compromise, necessitating immediate secret rotation and thorough remediation due to potential persistent access for attackers.

  • Package: npm / authvaultx
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~91/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'authvaultx' has been found to contain malware. Any system where this package is installed or executed should be considered fully compromised, indicating an attacker has gained complete control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is designed to deliver harmful capabilities upon installation or execution. Attackers leverage the trust in package ecosystems to distribute malware, often leading to unauthorized access or data exfiltration.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm dependencies
  • Any user or system that has directly or indirectly installed 'authvaultx'

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal package mirrors that do not vet upstream dependencies
  • Automated build processes that install new or updated dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets and keys stored on the compromised computer are exposed and can be used by the attacker.
  • The blast radius extends to any systems or services accessible from the compromised machine, including source code repositories, production environments, or sensitive data stores.

What to do (defensive)

Detect

  • Scan dependency trees for 'authvaultx' in all projects and environments.
  • Review npm installation logs and package manifests for unexpected inclusions of 'authvaultx'.
  • Monitor network traffic for unusual outbound connections from systems that might have installed this package.

Contain

  • Immediately isolate any system identified with 'authvaultx' installed from the network.
  • Quarantine affected build environments and developer workstations.
  • Block 'authvaultx' from being downloaded or installed by package managers and proxies.

Remediate

  • Consider any system that installed 'authvaultx' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, performing this action from a separate, trusted machine.
  • Audit all user accounts and permissions on affected systems and connected services for unauthorized changes.
  • Implement strict dependency pinning and review processes for all third-party packages.

Frontier verdict — High

Prioritize immediate investigation and remediation for 'authvaultx' due to critical severity and full system compromise risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.