Supply chain · npm · High

Critical npm Package 'whs4_npm_test' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-07

The npm package 'whs4_npm_test' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package should be removed, though complete remediation may require further action due to potential persistent compromise.

  • Package: npm / whs4_npm_test
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~483/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'whs4_npm_test' contains malware that, upon installation, fully compromises the host computer. This grants an external entity complete control over the system.

How the attack works

This is a malicious package attack where a seemingly legitimate or benign software component is introduced into a development or production environment. Once installed, the malicious code within the package executes, establishing unauthorized access and control over the host system, typically to exfiltrate sensitive data or maintain persistence.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'whs4_npm_test'

Conditions that increase exposure

  • Unpinned dependencies that automatically update to the malicious version
  • Lack of package lockfiles (e.g., package-lock.json) in projects
  • Internal package mirrors that have synchronized the malicious package
  • Automated build processes that install new or updated npm packages without prior vetting

Blast-radius scenarios

  • An attacker gains full control of the compromised computer.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The attacker may establish persistence, making simple package removal insufficient for full remediation.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan project dependencies for 'whs4_npm_test' using dependency analysis tools.
  • Review package-lock.json or yarn.lock files for the presence of 'whs4_npm_test'.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system identified with 'whs4_npm_test' installed.
  • Block 'whs4_npm_test' from being downloaded or installed from all package registries and mirrors.
  • Temporarily halt builds or deployments that might pull new npm dependencies until vetting processes are reinforced.

Remediate

  • Consider any system that installed 'whs4_npm_test' to be fully compromised.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from the compromised computer, performing this action from a different, trusted machine.
  • Remove 'whs4_npm_test' from all affected systems and project dependencies.
  • Perform a thorough forensic analysis of compromised systems to identify the full extent of the breach and any persistence mechanisms.
  • Rebuild compromised systems from trusted images if forensic analysis cannot guarantee full eradication of malicious software.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and thorough system remediation due to full system takeover.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.