Supply chain · npm · High

CRITICAL: Malicious 'endpointmap' npm package compromises host systems

Threat Engine Auto-Feed · data current as of 2026-06-30

A critical severity malicious package, 'endpointmap', has been identified in the npm ecosystem. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation due to potential persistent unauthorized access.

  • Package: npm / endpointmap
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~138/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'endpointmap' has been identified as malicious. Any system where this package has been installed or executed should be considered fully compromised, indicating an attacker has gained complete control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the package executes its malicious payload, granting an external entity unauthorized and full control over the host system, likely enabling credential or secret theft.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any team whose projects directly or indirectly depend on 'endpointmap'

Conditions that increase exposure

  • Unpinned dependency versions in package.json (e.g., using '*' or '^' for 'endpointmap')
  • Lack of package-lock.json or yarn.lock files, allowing dynamic resolution of malicious versions
  • Use of internal package mirrors that may not have filtered out the malicious package
  • Automated build systems that install dependencies without prior security scanning

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further lateral movement, or deployment of additional malware.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen, leading to broader organizational compromise.
  • The integrity of software built on the compromised system may be undermined, potentially injecting malicious code into downstream artifacts.

What to do (defensive)

Detect

  • Scan dependency trees for 'endpointmap' across all projects.
  • Review build logs and package installation histories for evidence of 'endpointmap' being pulled.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system identified with 'endpointmap' installed from the network.
  • Block 'endpointmap' from being downloaded from npm registries or internal mirrors.
  • Temporarily halt builds and deployments that rely on npm dependencies until a full audit is complete.

Remediate

  • Consider any system that installed 'endpointmap' to be fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from compromised systems, doing so from a separate, trusted machine.
  • Force-update all dependencies to known good, pinned versions and implement strict lockfile usage across all projects.

Frontier verdict — High

Prioritize immediate detection and isolation of 'endpointmap' installations, followed by comprehensive secret rotation and system rebuilds due to full compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.