Supply chain · npm · High

Critical npm package @servicetitan/standalone-core-feature-gates compromises systems

Threat Engine Auto-Feed · data current as of 2026-08-04

A malicious version of the npm package `@servicetitan/standalone-core-feature-gates` (1.11.4) has been identified, leading to full system compromise upon installation. This poses a critical supply-chain risk, necessitating immediate action to prevent credential theft and broader system control by attackers.

  • Package: npm / @servicetitan/standalone-core-feature-gates
  • Affected versions: = 1.11.4
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@servicetitan/standalone-core-feature-gates` version 1.11.4 contains malware. Installation of this specific version results in a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a supply-chain attack where a legitimate-looking software package is tampered with to include malicious code. When the compromised package is installed as a dependency, the embedded malware executes, leading to unauthorized access and control over the system where it runs.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any team or system that has installed version 1.11.4 of `@servicetitan/standalone-core-feature-gates`

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to vulnerable versions
  • Lack of lockfiles (e.g., `package-lock.json`) or not committing them to version control
  • Use of internal package mirrors that do not vet package integrity
  • Systems with broad network access or sensitive credentials that install npm packages

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen.
  • The attacker can use the compromised system as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for `@servicetitan/standalone-core-feature-gates` version 1.11.4.
  • Review build logs and dependency trees for any installation of the affected package version.
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages.

Contain

  • Immediately isolate any system identified as having installed `@servicetitan/standalone-core-feature-gates` version 1.11.4.
  • Block network access for compromised systems to prevent exfiltration and further lateral movement.
  • Temporarily suspend builds that pull npm packages until dependency vetting is confirmed.

Remediate

  • Consider any computer that installed `@servicetitan/standalone-core-feature-gates` version 1.11.4 as fully compromised.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, cloud credentials) that were stored on or accessible from the compromised computer, performing this action from a different, trusted machine.
  • Rebuild compromised systems from trusted images, as simply removing the package may not eliminate all malicious software.
  • Update dependency management practices to pin versions and use lockfiles to prevent automatic installation of malicious versions.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, credential rotation, and system rebuilds due to full system control by attackers.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.