Supply chain · npm · High

Critical npm package 'promo-helper' leads to full system compromise

Threat Engine Auto-Feed · data current as of 2026-07-08

The npm package 'promo-helper' has been identified as malicious, leading to full system compromise upon installation. This poses a critical risk, as all secrets and keys on an affected system should be considered compromised and require immediate rotation.

  • Package: npm / promo-helper
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~48/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'promo-helper' contains malware. Installation of this package results in a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly benign software component, when integrated into a project, executes unauthorized code. This typically involves the package's installation script or main logic performing actions beyond its stated purpose, such as establishing persistence or exfiltrating data.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that install npm dependencies
  • Any system where 'promo-helper' was directly or transitively installed

Conditions that increase exposure

  • Projects with unpinned dependencies that might pull the malicious version
  • Environments lacking strict dependency lockfiles (e.g., package-lock.json)
  • Internal package mirrors that have synchronized the malicious package

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets, keys, and sensitive data stored on the system are exposed and potentially exfiltrated.
  • The compromised system can be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan dependency trees for 'promo-helper' in any version.
  • Review build logs for 'promo-helper' installation events.
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages.

Contain

  • Immediately isolate any system identified with 'promo-helper' installed.
  • Block 'promo-helper' from being downloaded from npm registries or internal mirrors.
  • Review and update dependency policies to enforce strict version pinning and lockfile usage.

Remediate

  • Consider any system that installed 'promo-helper' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were present on or accessible from compromised systems, using a different, trusted machine.
  • Audit access logs for any suspicious activity originating from compromised systems prior to their isolation.

Frontier verdict — High

Prioritize immediate detection and isolation of systems with 'promo-helper' due to critical full system compromise and credential theft.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.