Supply chain · npm · High

CRITICAL: Malicious npm package 'openmct-heatmap' leads to full system compromise

Threat Engine Auto-Feed · data current as of 2026-09-18

The npm package 'openmct-heatmap' has been identified as malicious, leading to full system compromise upon installation. All systems that have installed this package should be considered compromised, requiring immediate secret rotation and thorough remediation.

  • Package: npm / openmct-heatmap
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'openmct-heatmap' contains malware. Installation of this package results in a full compromise of the host system, granting an outside entity complete control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is designed to execute unauthorized actions upon installation or execution. In this case, the malware embedded within 'openmct-heatmap' establishes full control over the compromised system, typically by installing persistent backdoors or remote access tools.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'openmct-heatmap'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing installation of any version
  • Lack of package-lock.json or yarn.lock to ensure consistent dependency versions
  • Use of internal mirrors that do not vet package integrity
  • Automated builds that install new or updated npm packages without review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen.
  • The compromised system can be used as a pivot point for lateral movement within an organization's network.

What to do (defensive)

Detect

  • Identify all systems where 'openmct-heatmap' has been installed.
  • Review package dependency trees for 'openmct-heatmap' in projects.

Contain

  • Immediately isolate any system identified with 'openmct-heatmap' installed from the network.
  • Block 'openmct-heatmap' from being downloaded or installed in your environment.

Remediate

  • Consider any system that installed 'openmct-heatmap' as fully compromised and re-image it.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Thoroughly audit the network for any signs of further compromise or persistence.

Frontier verdict — High

This is a critical severity malicious npm package requiring immediate action to identify, isolate, and remediate compromised systems and rotate all exposed secrets.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.