Supply chain · npm · High

CRITICAL: Malicious npm package 'alder_morrgan' compromises systems

Threat Engine Auto-Feed · data current as of 2026-07-04

A critical severity malicious npm package, 'alder_morrgan', has been identified. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation due to potential persistent access by attackers.

  • Package: npm / alder_morrgan
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~10/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'alder_morrgan' contains malware. Any system where this package has been installed or executed should be considered fully compromised, indicating an attacker has gained complete control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the malware executes, establishing unauthorized access and potentially exfiltrating sensitive data or credentials.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that pull npm dependencies
  • Organizations with internal package mirrors

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to vulnerable versions
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Automated build processes that install new or updated dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to further network penetration.
  • All secrets and keys stored on the compromised computer are exposed and can be used by an attacker.
  • The blast radius extends to any systems that interact with the compromised machine or use its credentials.

What to do (defensive)

Detect

  • Scan dependency trees for 'alder_morrgan' in all projects.
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages.
  • Review system logs for unexpected process execution or file modifications post-package installation.

Contain

  • Immediately isolate any system identified with 'alder_morrgan' installed.
  • Block network access for compromised systems to prevent further exfiltration or lateral movement.
  • Suspend all CI/CD pipelines and development activities that might pull this package.

Remediate

  • Consider any system that installed 'alder_morrgan' as fully compromised and reimage it from a trusted source.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, using a different, clean machine.
  • Remove 'alder_morrgan' from all package manifests and ensure it cannot be re-introduced.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and system remediation due to full system takeover.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.