Supply chain · npm · High

Critical: Malicious 'monitoring-service-util' npm package compromises systems

Threat Engine Auto-Feed · data current as of 2026-07-14

A critical vulnerability exists in the 'monitoring-service-util' npm package, which, if installed, fully compromises the host system. This allows for credential and secret theft, necessitating immediate rotation of all secrets and keys from an uncompromised machine.

  • Package: npm / monitoring-service-util
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~294/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'monitoring-service-util' npm package has been identified as malicious. Installation of this package leads to a full compromise of the computer, enabling an attacker to gain complete control.

How the attack works

This is a supply-chain attack where a malicious software package is introduced into a software ecosystem. When developers or automated systems integrate this package into their projects, the malicious code executes during installation or runtime, compromising the host system. The specific mechanism here is credential/secret theft.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any system where 'monitoring-service-util' has been installed

Conditions that increase exposure

  • Unpinned dependencies in package.json (e.g., using '*' or 'latest')
  • Lack of package-lock.json or yarn.lock files to ensure consistent dependency versions
  • Internal package mirrors that have not been updated or scanned for malicious packages
  • Automated build systems that install dependencies without prior vetting

Blast-radius scenarios

  • Attacker gains full control over the compromised computer
  • Theft of all secrets and keys stored on the compromised machine
  • Potential lateral movement within the network using stolen credentials
  • Data exfiltration or further malicious payload deployment

What to do (defensive)

Detect

  • Scan dependency trees for 'monitoring-service-util' in all projects
  • Review package-lock.json or yarn.lock files for its presence
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages

Contain

  • Immediately isolate any system found to have 'monitoring-service-util' installed
  • Block network access for compromised systems to prevent further compromise or data exfiltration

Remediate

  • Consider any computer with 'monitoring-service-util' installed as fully compromised
  • Rotate all secrets and keys (e.g., API keys, SSH keys, access tokens) stored on affected computers, performing this action from a different, uncompromised machine
  • Remove the 'monitoring-service-util' package, but acknowledge that full control may persist due to the nature of the compromise
  • Rebuild compromised systems from trusted images after ensuring all secrets are rotated

Frontier verdict — High

This is a critical priority due to full system compromise and credential theft, requiring immediate isolation and secret rotation.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.