Supply chain · npm · High

Critical npm Package 'cloudfcrxz' Compromises Systems, Demands Immediate Action

Threat Engine Auto-Feed · data current as of 2026-08-30

The npm package 'cloudfcrxz' is confirmed malicious, leading to full system compromise upon installation. All secrets and keys on affected machines must be rotated immediately, and the package removed, though full remediation may require further steps due to potential persistent access.

  • Package: npm / cloudfcrxz
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'cloudfcrxz' contains malware that, upon installation, fully compromises the host computer. This grants an outside entity potential full control over the affected system.

How the attack works

This is a malicious package attack where a seemingly legitimate or benign software component is introduced into a development or production environment. Once installed, the malicious code executes, establishing unauthorized access and control over the host system, typically to exfiltrate sensitive data or maintain persistence.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'cloudfcrxz'

Conditions that increase exposure

  • Unpinned or broad dependency ranges for 'cloudfcrxz'
  • Lack of package lockfiles (e.g., package-lock.json) in projects
  • Internal package mirrors that do not vet upstream packages
  • Automated build processes that install new or updated dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the compromised computer are exposed.
  • The attacker could establish persistence, making simple package removal insufficient for full remediation.
  • The compromised system could be used as a pivot point for further internal network attacks.

What to do (defensive)

Detect

  • Scan dependency trees for 'cloudfcrxz' in all projects.
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages.
  • Review system logs for unexpected process execution or file modifications on developer workstations and build servers.

Contain

  • Immediately isolate any system found to have 'cloudfcrxz' installed.
  • Block network access for compromised systems to prevent further exfiltration or lateral movement.
  • Suspend all CI/CD pipelines that may pull or build projects containing 'cloudfcrxz'.

Remediate

  • Consider any computer with 'cloudfcrxz' installed as fully compromised and untrustworthy.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on the compromised computer, performing this action from a different, trusted machine.
  • Remove the 'cloudfcrxz' package from all affected environments.
  • Perform a thorough forensic analysis and consider rebuilding compromised systems from trusted images to ensure complete eradication of malicious software.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, credential rotation, and system remediation due to full system takeover.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.