Supply chain · npm · High

Critical npm Package @servicetitan/examples Compromised

Threat Engine Auto-Feed · data current as of 2026-08-04

A malicious version of the npm package `@servicetitan/examples` (1.2.5) has been identified, leading to full system compromise upon installation. This poses a critical supply-chain risk, necessitating immediate action for any systems that have installed this specific version.

  • Package: npm / @servicetitan/examples
  • Affected versions: = 1.2.5
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@servicetitan/examples` version 1.2.5 contains malware. Installation of this package results in a complete compromise of the host system, allowing an external entity to gain full control.

How the attack works

This is a supply-chain attack where a legitimate-looking software package is injected with malicious code. When a developer or automated system installs the compromised package, the malicious code executes, leading to unauthorized access and control over the system.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull npm packages
  • Any system or user that has installed `@servicetitan/examples` version 1.2.5

Conditions that increase exposure

  • Unpinned dependencies that could resolve to the malicious version
  • Lack of package lockfiles or ignoring them during installation
  • Use of internal package mirrors that may have cached the compromised version
  • Automated builds or deployments that fetch the latest patch versions

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the affected computer are exposed.
  • The blast radius extends to any systems that interact with the compromised machine or use its credentials.

What to do (defensive)

Detect

  • Identify all instances where `@servicetitan/examples` version 1.2.5 might have been installed.
  • Review package lockfiles (e.g., `package-lock.json`, `yarn.lock`) for the presence of the affected version.
  • Scan build logs and dependency trees for installations of the malicious package.

Contain

  • Immediately isolate any system identified as having installed `@servicetitan/examples` version 1.2.5.
  • Prevent further installations of the compromised package by blocking version 1.2.5 in your package manager or registry.
  • Review and update dependency policies to pin versions and utilize lockfiles consistently.

Remediate

  • Consider any computer that installed `@servicetitan/examples` version 1.2.5 to be fully compromised.
  • Rotate all secrets and keys stored on affected computers from a different, trusted machine.
  • Perform a full forensic analysis and rebuild of compromised systems, as simply removing the package may not eliminate all malicious software.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, credential rotation, and system rebuild for any affected hosts.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.