Supply chain · npm · High

Critical npm 'security-node' package compromise: immediate action required

Threat Engine Auto-Feed · data current as of 2026-08-24

A critical vulnerability has been identified in the npm package 'security-node', which, if installed, fully compromises the host system. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further steps due to potential persistent compromise.

  • Package: npm / security-node
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~3/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'security-node' has been identified as malicious. Installation of this package leads to a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly innocuous or utility package is designed to execute harmful code upon installation or execution. Such packages often aim to establish persistence, exfiltrate sensitive data, or provide remote access to the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines pulling npm packages
  • Any system where 'security-node' was installed or run

Conditions that increase exposure

  • Unpinned dependencies that could pull the malicious package
  • Lack of lockfiles to ensure consistent dependency versions
  • Internal package mirrors that may have cached the malicious version

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The attacker may establish persistence, making simple package removal insufficient for remediation.

What to do (defensive)

Detect

  • Scan dependency trees for the 'security-node' package.
  • Review build logs and package installation histories for 'security-node' installation events.

Contain

  • Immediately isolate any systems identified with 'security-node' installed.
  • Block 'security-node' from being pulled from npm registries or internal mirrors.

Remediate

  • Consider any system that installed 'security-node' as fully compromised.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on the compromised computer, performing this action from a different, trusted system.
  • Remove the 'security-node' package from all affected systems.
  • Perform a thorough forensic analysis on compromised systems to identify and remove any persistent malicious software.

Frontier verdict — High

Prioritize immediate rotation of secrets and isolation of systems due to critical compromise from 'security-node' npm package.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.