Supply chain · npm · High

Critical npm Package 'saas-f-testing' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-21

The npm package 'saas-f-testing' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected machines must be rotated immediately from a separate, secure system.

  • Package: npm / saas-f-testing
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~21/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'saas-f-testing' contains malware. Installation of this package results in a complete compromise of the host computer, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the embedded malware executes, establishing unauthorized access and control over the host system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that automatically pull package dependencies
  • Any user or system that has directly or indirectly installed 'saas-f-testing'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing 'saas-f-testing' to be pulled
  • Lack of package-lock.json or similar lockfiles to ensure consistent dependency versions
  • Use of internal mirrors or caches that may have ingested the malicious package
  • Automated build processes that do not vet new or updated dependencies

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets, keys, and sensitive data stored on the compromised machine are exposed.
  • The compromised system can be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan dependency trees for 'saas-f-testing' in all projects.
  • Review package-lock.json or yarn.lock files for its presence.
  • Monitor network traffic for unusual outbound connections from systems that may have installed the package.

Contain

  • Immediately isolate any system found to have 'saas-f-testing' installed.
  • Block 'saas-f-testing' from being downloaded or installed in your environment via package registries or firewalls.
  • Suspend all processes and services running on compromised machines.

Remediate

  • Consider any system that installed 'saas-f-testing' to be fully compromised and unrecoverable without a full rebuild.
  • Rotate all secrets, API keys, and credentials that were present on the compromised machine, doing so from a different, secure computer.
  • Remove the 'saas-f-testing' package, but acknowledge this may not fully remove all malicious software due to potential deep system compromise.
  • Rebuild compromised systems from trusted images and apply least privilege principles.

Frontier verdict — High

This is a critical severity incident requiring immediate isolation, secret rotation, and system rebuilds for any affected npm environment.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.