Supply chain · npm · High

Critical npm Package 'svelte-goal-vim' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-15

The npm package 'svelte-goal-vim' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though complete remediation may require further action due to potential persistent compromise.

  • Package: npm / svelte-goal-vim
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The 'svelte-goal-vim' npm package contains malware. Installation of this package results in the complete compromise of the host system, potentially granting an external entity full control.

How the attack works

This is a malicious package attack, where a seemingly legitimate software component is designed to execute harmful code upon installation or execution. Such attacks typically aim to establish persistence, exfiltrate sensitive data, or enable further malicious activities on the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines configured to pull unpinned or latest versions of dependencies
  • Organizations with internal package mirrors that may have ingested this package

Conditions that increase exposure

  • Projects with unpinned dependencies that could inadvertently pull in a malicious version
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Automated build systems that do not perform static analysis or integrity checks on new dependencies

Blast-radius scenarios

  • An attacker gains full control over the compromised system, enabling data exfiltration, lateral movement, or further payload deployment.
  • All secrets and keys stored on the compromised machine are exposed and can be used by the attacker.
  • The attacker may establish persistence, making simple package removal insufficient for full remediation.

What to do (defensive)

Detect

  • Scan dependency trees for 'svelte-goal-vim' in all projects.
  • Review package installation logs for any instances of 'svelte-goal-vim' being pulled.

Contain

  • Immediately isolate any systems found to have 'svelte-goal-vim' installed from the network.
  • Block 'svelte-goal-vim' from being downloaded or installed in your environment via package managers or proxies.

Remediate

  • Consider any system that installed 'svelte-goal-vim' as fully compromised; re-image or rebuild the system from a trusted source.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, using a different, trusted machine.
  • Remove the 'svelte-goal-vim' package from all affected environments, understanding that this may not remove all malicious components.

Frontier verdict — High

Prioritize immediate investigation and remediation for any system that installed 'svelte-goal-vim' due to critical system compromise and credential theft risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.