Supply chain · npm · High

Critical npm package 'type-elint' compromises systems via supply chain attack

Threat Engine Auto-Feed · data current as of 2026-07-12

A malicious version of the 'type-elint' npm package (3.3.7) has been identified, leading to full system compromise upon installation. This supply chain attack poses a critical risk to development environments and any systems where the package was installed, necessitating immediate action to prevent credential theft and further compromise.

  • Package: npm / type-elint
  • Affected versions: = 3.3.7
  • Severity: critical
  • Reach: ~317/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

A malicious version of the 'type-elint' npm package (3.3.7) was published. Installation of this specific version results in the complete compromise of the host system. The advisory indicates that an outside entity may gain full control of the computer.

How the attack works

This is a software supply chain attack where a legitimate-looking package is injected with malicious code. When a developer or automated system installs the compromised package, the embedded malicious code executes, establishing unauthorized access and control over the host system. This type of attack often targets sensitive data like credentials and secrets.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any team whose build processes or applications depend on 'type-elint'

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to vulnerable versions
  • Lack of package lockfiles (e.g., package-lock.json) in projects
  • Use of internal package mirrors that may not filter malicious versions
  • Systems where 'type-elint' version 3.3.7 was directly or transitively installed

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration.
  • All secrets and keys stored on the compromised computer are at risk of theft.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan project dependency trees for 'type-elint' version 3.3.7.
  • Review build logs and package installation histories for evidence of 'type-elint@3.3.7' being pulled.
  • Monitor network traffic from development machines for unusual outbound connections.

Contain

  • Immediately isolate any system identified with 'type-elint' version 3.3.7 installed.
  • Block 'type-elint@3.3.7' in your package registries and proxies to prevent further installations.
  • Temporarily suspend builds that depend on 'type-elint' until remediation is complete.

Remediate

  • Consider any system that installed 'type-elint@3.3.7' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from compromised systems, using a different, trusted computer.
  • Remove the malicious package from all affected environments; however, acknowledge that full system control may have been ceded, and removal alone may not eliminate all malicious software.

Frontier verdict — High

Prioritize immediate identification and isolation of systems with 'type-elint@3.3.7' due to critical system compromise and credential theft risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.