Supply chain · npm · High

Critical Malicious Package 'online-header' Identified in npm Ecosystem

Threat Engine Auto-Feed · data current as of 2026-10-01

A malicious package, 'online-header' version 99.0.0, has been identified in the npm ecosystem. This package is considered critical due to its communication with a known malicious domain, posing a supply-chain risk to any systems that installed it.

  • Package: npm / online-header
  • Affected versions: = 99.0.0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

The OpenSSF Package Analysis project identified 'online-header' version 99.0.0 as malicious. The package was flagged because it communicates with a domain associated with malicious activity.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is compromised to include harmful code. When installed, the package executes its malicious payload, in this case, establishing communication with an attacker-controlled domain. This could lead to data exfiltration, further compromise, or remote control of the affected system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that pull npm packages
  • Organizations with internal npm mirrors

Conditions that increase exposure

  • Unpinned dependencies that could resolve to the malicious version
  • Lack of `package-lock.json` or equivalent lockfiles
  • Automated builds that fetch the latest package versions
  • Use of internal mirrors that have not been updated to exclude the malicious package

Blast-radius scenarios

  • If installed, the package could establish outbound connections to a malicious domain, potentially exfiltrating sensitive data or downloading additional malware.
  • Compromised build environments could lead to malicious code being injected into downstream artifacts, affecting users of those artifacts.
  • Developer workstations could be compromised, providing attackers with access to source code, credentials, or internal networks.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for 'online-header' version 99.0.0.
  • Monitor network traffic for outbound connections to known malicious domains, specifically those associated with 'online-header'.
  • Utilize software composition analysis (SCA) tools to identify vulnerable or malicious dependencies.

Contain

  • Immediately block 'online-header' version 99.0.0 from all package registries and mirrors.
  • Isolate any systems identified as having installed the malicious package.
  • Review network firewall rules to block communication with the malicious domain.

Remediate

  • Remove 'online-header' version 99.0.0 from all affected projects and systems.
  • Force a dependency resolution to ensure no malicious versions are pulled.
  • Rotate credentials and API keys used in any potentially compromised build environments or developer workstations.
  • Conduct a thorough forensic analysis on any systems that installed the package to determine the extent of compromise.

Frontier verdict — High

Prioritize immediate detection and removal of 'online-header' version 99.0.0 due to its critical severity and communication with a malicious domain.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.