Supply chain · npm · High

Critical Malware in npm Package 'digital-interview-digital-interview-core'

Threat Engine Auto-Feed · data current as of 2026-08-19

A malicious npm package, 'digital-interview-digital-interview-core', has been identified as malware. Any system where this package was installed should be considered fully compromised, necessitating immediate secret rotation and thorough remediation.

  • Package: npm / digital-interview-digital-interview-core
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~16/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'digital-interview-digital-interview-core' has been flagged as containing malware. Installation of this package leads to a full system compromise, allowing an external entity to gain control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component, once integrated into a project, executes unauthorized code. This typically involves the package's installation script or main logic performing actions beyond its declared purpose, such as exfiltrating sensitive data or establishing persistent access.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'digital-interview-digital-interview-core'

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Internal package mirrors that do not vet upstream changes
  • Automated build processes that install new or updated dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, lateral movement within the network, or further malware deployment.
  • All secrets and keys stored on the compromised computer are exposed and can be used by the attacker.
  • The integrity of development environments or production systems could be severely undermined.

What to do (defensive)

Detect

  • Review package-lock.json or yarn.lock files for 'digital-interview-digital-interview-core'
  • Scan project dependencies for the presence of 'digital-interview-digital-interview-core'
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package

Contain

  • Immediately isolate any system identified as having installed 'digital-interview-digital-interview-core'
  • Block network access for compromised systems to prevent further communication with external adversaries
  • Suspend any CI/CD pipelines or automated processes that could install this package

Remediate

  • Consider any system that installed 'digital-interview-digital-interview-core' as fully compromised and rebuild from a clean image if possible.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from the compromised computer, performing this action from a different, trusted system.
  • Remove the 'digital-interview-digital-interview-core' package, but acknowledge that full control may have been given to an outside entity, meaning removal alone may not eliminate all malicious software.

Frontier verdict — High

Prioritize immediate investigation and remediation for any system that installed 'digital-interview-digital-interview-core' due to critical system compromise risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.