Supply chain · npm · High

Critical Malware in npm Package @postman-cse/okta-aio-linux-arm64

Threat Engine Auto-Feed · data current as of 2026-08-22

A critical malware advisory has been issued for the npm package `@postman-cse/okta-aio-linux-arm64` version `0.8.10`. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation.

  • Package: npm / @postman-cse/okta-aio-linux-arm64
  • Affected versions: = 0.8.10
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@postman-cse/okta-aio-linux-arm64` version `0.8.10` has been identified as malicious. Any system where this package was installed or executed should be considered fully compromised.

How the attack works

This is a malicious package attack where a compromised version of a software component is introduced into the supply chain. Upon installation, the package executes malicious code, leading to unauthorized access and control over the host system. The specific mechanism of compromise is not detailed, but the outcome is full system control by an external entity.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull npm packages
  • Any system administrator or developer who installed this specific package

Conditions that increase exposure

  • Projects with unpinned dependencies that might automatically update to malicious versions
  • Build systems without lockfiles or integrity checks for npm packages
  • Internal package mirrors that may have cached the malicious version

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or deployment of additional malicious software.
  • All secrets and keys stored on the compromised computer are exposed and can be used by the attacker.

What to do (defensive)

Detect

  • Scan project dependencies for `@postman-cse/okta-aio-linux-arm64` version `0.8.10`.
  • Review system logs for unusual activity on machines that installed this package.
  • Check package lockfiles (e.g., `package-lock.json`, `yarn.lock`) for the presence of the malicious version.

Contain

  • Immediately isolate any system identified as having installed `@postman-cse/okta-aio-linux-arm64` version `0.8.10` from the network.
  • Block the malicious package from being downloaded from npm registries or internal mirrors.

Remediate

  • Consider any compromised system as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, performing this action from a different, trusted computer.
  • Remove the malicious package from all affected environments, understanding that full system control may persist even after removal.

Frontier verdict — High

Prioritize immediate isolation and secret rotation for any system that installed `@postman-cse/okta-aio-linux-arm64` version `0.8.10` due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.