Supply chain · npm · High

Critical npm package 'iot-kfh-s3' compromises host systems

Threat Engine Auto-Feed · data current as of 2026-07-20

The npm package 'iot-kfh-s3' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / iot-kfh-s3
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~135/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'iot-kfh-s3' contains malware that, when installed, fully compromises the host computer. This grants an outside entity complete control over the system.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the malware executes, establishing unauthorized access and control over the host system, likely enabling data exfiltration or further payload deployment.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has directly or indirectly installed 'iot-kfh-s3'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing automatic updates to malicious versions
  • Lack of package-lock.json or yarn.lock to ensure consistent dependency versions
  • Use of internal mirrors that do not vet package integrity
  • Automated build systems that install dependencies without strict versioning

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, lateral movement within the network, or deployment of additional malicious software.
  • All secrets, credentials, and sensitive data stored on the compromised computer are at risk of theft.
  • The compromised system could be used as a pivot point for further attacks against an organization's infrastructure.

What to do (defensive)

Detect

  • Scan dependency trees for 'iot-kfh-s3' in all projects and environments.
  • Monitor network traffic for unusual outbound connections from systems that have installed npm packages.
  • Review system logs for suspicious process execution or file modifications post-package installation.

Contain

  • Immediately isolate any system identified with 'iot-kfh-s3' installed from the network.
  • Block 'iot-kfh-s3' from being downloaded or installed in package registries and CI/CD pipelines.
  • Suspend all processes and services running on compromised machines.

Remediate

  • Consider any computer with 'iot-kfh-s3' installed as fully compromised and re-image if possible.
  • Rotate all secrets, API keys, and credentials stored on or accessible from the compromised computer, using a different, trusted system.
  • Remove the 'iot-kfh-s3' package from all affected systems and projects, then verify system integrity through comprehensive security scans.

Frontier verdict — High

Prioritize immediate detection and isolation of 'iot-kfh-s3' due to critical system compromise and credential theft risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.