Supply chain · npm · High

Critical npm package 'web-api-node' identified as malware, leading to full compromise

Threat Engine Auto-Feed · data current as of 2026-07-03

The npm package 'web-api-node' has been identified as malware, leading to full system compromise upon installation. This poses a critical supply-chain risk, requiring immediate action to detect, contain, and remediate any systems where it may have been introduced.

  • Package: npm / web-api-node
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~19/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'web-api-node' has been found to contain malicious code. Installation of this package results in the complete compromise of the host system, allowing an external entity to gain full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful capabilities into a system. Upon installation, the package executes code that compromises the host, typically by establishing persistence, exfiltrating data, or enabling remote control.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any system where 'web-api-node' has been directly or transitively installed

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing 'web-api-node' to be pulled in
  • Lack of package-lock.json or yarn.lock files to ensure consistent dependency versions
  • Use of internal package mirrors that may not have been updated to block the malicious package
  • Automated build processes that install dependencies without prior vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The compromised system can be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan dependency trees for 'web-api-node' across all projects and environments.
  • Review package-lock.json or yarn.lock files for any presence of 'web-api-node'.
  • Monitor network traffic for unusual outbound connections from systems where npm packages are installed or built.

Contain

  • Immediately isolate any systems identified with 'web-api-node' installed.
  • Block 'web-api-node' from being downloaded or installed via package managers and internal registries.
  • Review and update CI/CD configurations to prevent installation of this specific package.

Remediate

  • Consider any computer with 'web-api-node' installed as fully compromised and rebuild from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on the compromised computer, performing this action from a different, trusted machine.
  • Remove the 'web-api-node' package, but acknowledge that this may not fully remove all malicious software due to potential full system compromise.

Frontier verdict — High

This critical npm package compromise requires immediate investigation and remediation due to full system compromise capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.