Supply chain · npm · High

CRITICAL: Malicious npm package '@higherlogic/ocfe' leads to full system compromise

Threat Engine Auto-Feed · data current as of 2026-07-10

The npm package '@higherlogic/ocfe' has been identified as malicious, leading to full system compromise upon installation. All systems that have installed this package should be considered compromised, requiring immediate secret rotation and thorough remediation.

  • Package: npm / @higherlogic/ocfe
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package '@higherlogic/ocfe' contains malware. Installation of this package results in a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component, when integrated into a project, executes unauthorized code. This typically involves the package's installation script or main logic performing actions beyond its stated purpose, such as exfiltrating data or establishing persistent access.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any user or system that has directly or indirectly installed '@higherlogic/ocfe'

Conditions that increase exposure

  • Unpinned dependency versions in package.json (e.g., using '*' or '^' for '@higherlogic/ocfe')
  • Lack of package-lock.json or yarn.lock files, allowing dynamic dependency resolution
  • Use of internal package mirrors that may not have updated or flagged the malicious package
  • Automated build processes that install dependencies without prior vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, lateral movement, or further malicious deployments.
  • All secrets and keys stored on the compromised computer are at risk of theft and misuse.
  • The integrity of software built on the compromised system may be compromised, leading to downstream supply chain risks.

What to do (defensive)

Detect

  • Review dependency trees for '@higherlogic/ocfe' in package.json and lock files.
  • Scan build artifacts and deployed systems for indicators of compromise related to this package.
  • Monitor network traffic for unusual outbound connections from systems that installed the package.

Contain

  • Immediately isolate any system identified with '@higherlogic/ocfe' installed.
  • Block '@higherlogic/ocfe' from being downloaded or installed in your environment via package registries or firewalls.
  • Suspend any CI/CD pipelines or automated processes that may install this package.

Remediate

  • Consider any system that installed '@higherlogic/ocfe' as fully compromised and rebuild from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from compromised systems, doing so from a different, trusted computer.
  • Perform a thorough forensic analysis to understand the extent of the compromise, though full removal of malicious software cannot be guaranteed by simply uninstalling the package.

Frontier verdict — High

This is a critical severity supply-chain compromise requiring immediate isolation, secret rotation, and system rebuilds due to full system control granted to attackers.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.