Supply chain · npm · High

Critical Malware Alert: npm package @xxxfnbs21/hello-demo compromises systems

Threat Engine Auto-Feed · data current as of 2026-10-14

The npm package `@xxxfnbs21/hello-demo` contains malware that fully compromises any system where it is installed or run. This necessitates immediate action to rotate credentials and isolate affected systems, as the package grants an attacker full control.

  • Package: npm / @xxxfnbs21/hello-demo
  • Affected versions: = 0.0.0-stage
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@xxxfnbs21/hello-demo` version `0.0.0-stage` has been identified as malicious. Installation or execution of this package leads to a complete compromise of the host system.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces unauthorized capabilities. Upon installation or execution, the package establishes full control over the compromised system, enabling an attacker to perform arbitrary actions, including credential theft.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed or run `@xxxfnbs21/hello-demo`

Conditions that increase exposure

  • Unpinned dependencies that could resolve to the malicious version
  • Lack of package lockfiles (e.g., `package-lock.json`)
  • Internal package mirrors that have synchronized the malicious package

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The compromised system can be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan package manifests (e.g., `package.json`) for `@xxxfnbs21/hello-demo`.
  • Review `package-lock.json` or equivalent lockfiles for the presence of `@xxxfnbs21/hello-demo` version `0.0.0-stage`.
  • Monitor network traffic for unusual outbound connections from systems that might have installed this package.

Contain

  • Immediately isolate any system identified as having installed or run `@xxxfnbs21/hello-demo`.
  • Prevent further installations of `@xxxfnbs21/hello-demo` by blocking it at the registry or proxy level.
  • Review and update CI/CD configurations to ensure package integrity checks and dependency pinning.

Remediate

  • Consider any compromised computer as fully compromised; re-image or rebuild from a trusted source.
  • Rotate all secrets and keys (API keys, credentials, SSH keys, etc.) that were stored on or accessible from the compromised computer, performing this action from a different, trusted system.
  • Remove the `@xxxfnbs21/hello-demo` package; however, note that this action alone may not remove all malicious software due to the nature of full system compromise.

Frontier verdict — High

Prioritize immediate isolation and credential rotation for any system exposed to the critical npm malware `@xxxfnbs21/hello-demo`.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.