Supply chain · npm · High

Critical Malware in npm Package 'test899-auth' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-09-18

A malicious npm package, 'test899-auth', has been identified as malware, leading to full system compromise upon installation. This poses a critical supply chain risk, requiring immediate action to detect, contain, and remediate affected systems and rotate credentials.

  • Package: npm / test899-auth
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'test899-auth' has been identified as malware. Installation or execution of this package results in a full compromise of the host system, granting an outside entity complete control.

How the attack works

This is a malicious package attack where an attacker publishes a seemingly legitimate software component containing harmful code. When developers integrate this package into their projects, the malicious code is executed, allowing the attacker to gain unauthorized access and control over the system where the package is installed or run.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any user or system that has directly or indirectly installed 'test899-auth'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing installation of any version
  • Lack of package-lock.json or yarn.lock files to ensure deterministic builds
  • Use of internal mirrors or caches that may have ingested the malicious package
  • Automated build processes that do not vet new or updated dependencies

Blast-radius scenarios

  • If 'test899-auth' is installed, an attacker achieves full control over the compromised computer.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The blast radius includes any system that has installed or run the package, potentially leading to further network intrusion or data breaches.

What to do (defensive)

Detect

  • Scan dependency trees for 'test899-auth' across all projects and environments.
  • Review package-lock.json/yarn.lock files for the presence of 'test899-auth'.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system identified as having 'test899-auth' installed or run.
  • Block network access for compromised systems to prevent further exfiltration or lateral movement.
  • Suspend any build or deployment processes that might pull or use this package.

Remediate

  • Consider any computer that has installed or run 'test899-auth' as fully compromised and rebuild from a trusted image.
  • Rotate all secrets and keys (e.g., API tokens, SSH keys, credentials) that were stored on or accessible from the compromised computer, performing this action from a different, uncompromised system.
  • Remove 'test899-auth' from all dependency lists; however, note that removal alone may not eliminate all malicious software due to the nature of full system compromise.

Frontier verdict — High

This critical npm malware requires immediate investigation and comprehensive remediation due to full system compromise and credential theft risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.