Supply chain · npm · High

Critical npm Package @crysnovax/plug Compromises Systems, Demands Immediate Action

Threat Engine Auto-Feed · data current as of 2026-09-04

A malicious version of the npm package `@crysnovax/plug` has been identified, leading to full system compromise upon installation. This supply chain attack targets credentials and secrets, necessitating immediate rotation of all sensitive data from an uncompromised system. Organizations using this package should prioritize containment and remediation.

  • Package: npm / @crysnovax/plug
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@crysnovax/plug` contains malware. Any system where this package has been installed or executed should be considered fully compromised. The primary objective of this malware is credential and secret theft.

How the attack works

This is a supply-chain attack where a legitimate-looking software package is distributed through a public registry but contains malicious code. When the package is installed and executed, it performs unauthorized actions, in this case, compromising the host system to steal credentials and secrets. The nature of the compromise means an external entity may gain full control.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any system administrator or developer who has installed `@crysnovax/plug`

Conditions that increase exposure

  • Unpinned dependencies in `package.json` that allow pulling the malicious version
  • Lack of lockfiles (`package-lock.json`, `npm-shrinkwrap.json`) or not committing them
  • Use of internal mirrors that have not synchronized a patched version or blocked the malicious one
  • Automated build processes that install dependencies without prior vetting

Blast-radius scenarios

  • An attacker gains full control of the compromised system, potentially leading to further network infiltration.
  • All secrets (API keys, tokens, credentials) stored on the compromised machine are exfiltrated.
  • The compromised system could be used as a pivot point for lateral movement within the network or to launch further attacks.

What to do (defensive)

Detect

  • Identify all systems that have installed or run `@crysnovax/plug`.
  • Review `package.json` and `package-lock.json` files in projects for the presence of `@crysnovax/plug`.
  • Scan systems for indicators of compromise (IOCs) associated with credential theft (though specific IOCs are not provided, general malware scanning is advised).

Contain

  • Immediately isolate any identified compromised systems from the network.
  • Block `@crysnovax/plug` from being downloaded from npm registries or internal mirrors.
  • Suspend any CI/CD pipelines that might be installing this package.

Remediate

  • Consider all secrets and keys stored on compromised systems to be compromised; rotate them immediately from a different, uncompromised computer.
  • Rebuild compromised systems from trusted images, as simply removing the package may not fully eliminate the threat.
  • Implement stricter dependency vetting processes, including pinning versions and reviewing new package introductions.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate system isolation and credential rotation due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.