Supply chain · npm · High

Critical npm package 'txs-lib-sdk' compromises systems, demands immediate action

Threat Engine Auto-Feed · data current as of 2026-09-29

The npm package 'txs-lib-sdk' has been identified as malicious, leading to full system compromise upon installation. This poses a critical threat, requiring immediate rotation of all secrets and keys from an uncompromised system.

  • Package: npm / txs-lib-sdk
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~130/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'txs-lib-sdk' npm package contains malware that, when installed, fully compromises the host computer. This allows an attacker to gain complete control over the system.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the embedded malware executes, establishing unauthorized access and control over the host system, typically for data exfiltration or further compromise.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'txs-lib-sdk'

Conditions that increase exposure

  • Projects with unpinned dependencies that might pull the malicious package
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock) to ensure consistent dependency versions
  • Use of internal package mirrors that do not vet upstream packages for known vulnerabilities or malicious content

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the compromised computer are exposed.
  • The blast radius extends to any systems or services accessible from the compromised machine, potentially leading to broader network intrusion or data breaches.

What to do (defensive)

Detect

  • Scan project dependency trees for 'txs-lib-sdk'.
  • Review package installation logs for 'txs-lib-sdk' being pulled.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system identified with 'txs-lib-sdk' installed from the network.
  • Prevent further installations of 'txs-lib-sdk' by blocking it in package registries or firewalls.
  • Review and update dependency pinning strategies to prevent automatic updates to potentially malicious versions.

Remediate

  • Consider any system that installed 'txs-lib-sdk' as fully compromised and reimage it.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, performing this action from a known clean machine.
  • Remove 'txs-lib-sdk' from all project dependencies and ensure it cannot be re-introduced.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate system isolation, secret rotation, and remediation due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.