Supply chain · npm · High

CRITICAL: Malicious npm package 'lib-mtop' leads to full system compromise

Threat Engine Auto-Feed · data current as of 2026-07-28

The npm package 'lib-mtop' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems should be rotated immediately, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / lib-mtop
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~85/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The 'lib-mtop' npm package contains malware. Installation of this package results in the complete compromise of the host system, granting an external entity full control.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a software ecosystem. When developers or automated systems install or integrate the compromised package, the malicious code executes, leading to unauthorized access and control over the system where it was installed.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package dependencies
  • Any user or system that has installed 'lib-mtop'

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest (malicious) version of 'lib-mtop'
  • Lack of package lockfiles (e.g., package-lock.json) or not committing them to version control
  • Use of internal package mirrors that may not have updated to block the malicious package
  • Automated build processes that install dependencies without manual review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen or misused by the attacker.
  • The integrity of software built on the compromised system may be compromised, leading to further supply chain risks.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of 'lib-mtop' (any version).
  • Review package lockfiles (e.g., package-lock.json) to identify if 'lib-mtop' is listed.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any systems identified as having 'lib-mtop' installed from the network.
  • Block 'lib-mtop' from being downloaded or installed in your environment via package managers or proxies.
  • Suspend any automated builds or deployments that might pull new dependencies until a review is complete.

Remediate

  • Consider any system that installed 'lib-mtop' to be fully compromised and initiate incident response procedures.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, using a different, trusted computer.
  • Remove the 'lib-mtop' package from all affected systems. However, be aware that full control may have been given to an attacker, so complete remediation might require rebuilding systems from trusted images.

Frontier verdict — High

Prioritize immediate action due to critical severity and full system compromise risk from 'lib-mtop'.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.