Supply chain · npm · High

Critical Malicious Package 'vs-modules' in npm Executes Remote Code on Install

Threat Engine Auto-Feed · data current as of 2026-08-29

A critical malicious package, 'vs-modules' version 1.2.2, in the npm ecosystem contains obfuscated code that automatically downloads and executes a remote batch file during installation. This poses a significant supply-chain risk, allowing arbitrary code execution on developer or CI/CD systems that install the package.

  • Package: npm / vs-modules
  • Affected versions: = 1.2.2
  • Severity: critical
  • Reach: ~401/wk
  • Exposure: 70/100 (High)

What happened — Malicious package

The npm package 'vs-modules' version 1.2.2 includes a 'preinstall' hook that automatically executes a heavily obfuscated JavaScript file, 'resources.js', upon installation. This script is designed to download a batch file from a remote, unauthenticated URL (http://whaomydaddy.bts-the-time-in-shanghai.netlify.app/hey.bat) into the system's temporary directory and immediately execute it. The package's stated purpose is unrelated to this malicious behavior.

How the attack works

This is a malicious package attack where an attacker publishes a seemingly legitimate software component containing hidden, harmful code. When a user or automated system installs the package, the embedded malicious script is triggered, typically via a lifecycle hook (like 'preinstall' in npm). This script then performs unauthorized actions, such as downloading and executing additional payloads from external sources, compromising the host system.

Who's exposed

Profiles most at risk

  • Development teams using npm for their projects
  • CI/CD pipelines that automatically pull and install npm dependencies
  • Any system where 'vs-modules' version 1.2.2 has been installed

Conditions that increase exposure

  • Projects with unpinned dependencies that might inadvertently update to the malicious version
  • Build systems that do not use lockfiles or have outdated lockfiles
  • Organizations that use internal npm mirrors without thorough package vetting
  • Environments where 'npm install' is run with elevated privileges

Blast-radius scenarios

  • An attacker gains remote code execution on a developer's workstation, potentially leading to credential theft or further network penetration.
  • An attacker compromises a CI/CD build agent, allowing them to inject malicious code into downstream artifacts or access sensitive build secrets.
  • An attacker establishes persistence on compromised systems by installing additional malware via the executed batch file.

What to do (defensive)

Detect

  • Scan existing projects for 'vs-modules' version 1.2.2 in package.json or lockfiles.
  • Monitor network traffic for suspicious outbound connections to 'http://whaomydaddy.bts-the-time-in-shanghai.netlify.app' during package installation.
  • Implement software composition analysis (SCA) tools to identify known malicious packages and vulnerable dependencies.
  • Review npm package scripts, especially 'preinstall' or 'postinstall' hooks, for unusual or obfuscated commands.

Contain

  • Immediately quarantine any systems identified as having installed 'vs-modules' version 1.2.2.
  • Block network access to 'http://whaomydaddy.bts-the-time-in-shanghai.netlify.app' at the firewall or proxy level.
  • Remove 'vs-modules' version 1.2.2 from all dependency lists and package registries.
  • Temporarily disable or restrict 'npm install' operations in critical environments until a full assessment is complete.

Remediate

  • Uninstall 'vs-modules' version 1.2.2 from all affected systems and replace with a trusted, verified alternative if functionality is needed.
  • Perform a comprehensive security audit of all systems that installed the malicious package, including checking for persistence mechanisms or additional malware.
  • Update all project dependencies to use pinned versions and ensure lockfiles are consistently used and committed.
  • Educate development teams on the risks of supply-chain attacks and best practices for dependency management.

Frontier verdict — High

Prioritize immediate detection and removal of 'vs-modules' version 1.2.2 due to critical remote code execution risk during installation.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.