Supply chain · npm · High

Malicious npm package 'keroeltop' identified communicating with suspicious domain

Threat Engine Auto-Feed · data current as of 2026-09-19

The npm package 'keroeltop' version 99.99.99 has been identified as malicious due to its communication with a domain associated with malicious activity. Organizations using this specific version are at high risk of compromise, necessitating immediate detection and remediation efforts.

  • Package: npm / keroeltop
  • Affected versions: = 99.99.99
  • Severity: critical
  • Reach: ~129/wk
  • Exposure: 70/100 (High)

What happened — Malicious package

The npm package 'keroeltop' at version 99.99.99 was flagged as malicious by the OpenSSF Package Analysis project. The primary indicator of malicious activity is its communication with a domain known to be associated with hostile operations.

How the attack works

This is a malicious package attack, where a seemingly legitimate or dependency package contains hidden, harmful code. When installed and executed, such packages can perform unauthorized actions, including establishing communication with attacker-controlled infrastructure for data exfiltration, command and control, or further payload delivery.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package dependencies
  • Any team or project that has 'keroeltop' version 99.99.99 as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned or broad dependency ranges that allow automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) in deployment environments
  • Use of internal package mirrors that do not vet packages for known malicious indicators
  • Environments without egress filtering or network monitoring that could detect suspicious outbound connections

Blast-radius scenarios

  • An attacker could establish a covert communication channel from compromised systems.
  • The package could facilitate data exfiltration from the build environment or runtime.
  • The malicious communication could be a precursor to further stages of an attack, such as downloading additional malware or receiving commands.

What to do (defensive)

Detect

  • Scan all project dependencies for 'keroeltop' version 99.99.99 using dependency analysis tools.
  • Review network logs for outbound connections from build systems or applications to suspicious domains.
  • Utilize software composition analysis (SCA) tools to identify known malicious packages in your codebase.

Contain

  • Immediately quarantine or remove any systems found to have installed 'keroeltop' version 99.99.99.
  • Block network communication to any domains identified as malicious by the package.
  • Temporarily halt deployments that include the affected package until remediation is complete.

Remediate

  • Remove 'keroeltop' version 99.99.99 from all project dependencies.
  • Update package lockfiles to explicitly pin known-good versions of all dependencies.
  • Implement strict dependency versioning to prevent automatic updates to potentially malicious versions.
  • Conduct a thorough security audit of any systems that installed the malicious package to identify and remove any persistent compromise.

Frontier verdict — High

This critical severity malicious npm package requires immediate attention due to its suspicious network communication and potential for compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.