Supply chain · npm · Critical

Critical npm package 'node-fsagent' compromises systems, enabling credential theft

Threat Engine Auto-Feed · data current as of 2026-07-14

The npm package 'node-fsagent' has been identified as malicious, leading to full system compromise upon installation. This poses a critical supply-chain risk, as all secrets and keys on affected systems are exposed and require immediate rotation.

  • Package: npm / node-fsagent
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~20,183/wk
  • Exposure: 90/100 (Critical)

What happened — Credential / secret theft

The 'node-fsagent' npm package contains malware that, when installed, fully compromises the host computer. This allows an external entity to gain complete control over the system.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is weaponized. Upon installation, the embedded malware executes, establishing unauthorized access and control over the system, typically exfiltrating sensitive data or installing further malicious software.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has 'node-fsagent' installed

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing automatic updates to malicious versions
  • Lack of package-lock.json or yarn.lock to ensure consistent dependency versions
  • Internal package mirrors that have not been updated to block the malicious package
  • Automated build processes that install dependencies without prior vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets, keys, and sensitive data stored on the compromised computer are exposed and potentially exfiltrated.
  • The compromised system can be used as a pivot point for further attacks within the network.
  • The integrity and confidentiality of development environments and build systems are severely undermined.

What to do (defensive)

Detect

  • Scan dependency trees for 'node-fsagent' (any version).
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages.
  • Review system logs for unauthorized process execution or file modifications post-package installation.

Contain

  • Immediately isolate any system identified with 'node-fsagent' installed.
  • Block 'node-fsagent' from being downloaded or installed from all package registries and mirrors.
  • Suspend any CI/CD pipelines or automated processes that might install this package.

Remediate

  • Consider any system that installed 'node-fsagent' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, keys, and credentials that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Audit all code repositories for unauthorized changes or injected malicious code.
  • Implement strict dependency version pinning and review processes for new package introductions.

Frontier verdict — Critical

Prioritize immediate detection and remediation of 'node-fsagent' due to critical system compromise and credential theft risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.