Supply chain · npm · High

Critical Supply Chain Alert: Malicious @aircanada/components npm Package

Threat Engine Auto-Feed · data current as of 2026-09-07

A malicious version of the `@aircanada/components` npm package has been identified, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated, and the compromised systems should be considered untrustworthy even after package removal.

  • Package: npm / @aircanada/components
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The `@aircanada/components` npm package has been compromised with malware. Installation of any version of this package results in a complete compromise of the host system.

How the attack works

This is a malicious package attack where an attacker injects harmful code into a software component. When this component is integrated into a project and installed, the malicious code executes, potentially granting the attacker unauthorized access or control over the system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that build projects depending on this package
  • Any system where the `@aircanada/components` package has been installed

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest (potentially malicious) version
  • Lack of lockfiles (e.g., `package-lock.json`) to ensure consistent dependency versions
  • Internal package mirrors that do not vet incoming packages
  • Automated build processes that pull dependencies without prior security scanning

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets, keys, and sensitive data on the system are exposed.
  • The compromised system can be used as a pivot point for further attacks within the network.
  • Data exfiltration from the compromised environment.

What to do (defensive)

Detect

  • Audit `package.json` and `package-lock.json` files for the presence of `@aircanada/components`.
  • Scan build logs and dependency trees for installations of `@aircanada/components`.
  • Monitor network traffic for unusual outbound connections from systems that installed this package.

Contain

  • Immediately isolate any system identified with the `@aircanada/components` package installed.
  • Block all network access for compromised systems to prevent further attacker activity.
  • Suspend any CI/CD pipelines or automated processes that may install this package.

Remediate

  • Consider any system that installed `@aircanada/components` to be fully compromised and untrustworthy.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, using a different, trusted system.
  • Rebuild compromised systems from trusted images or backups, ensuring the malicious package is not reintroduced.
  • Remove `@aircanada/components` from all project dependencies and ensure it is not installed in any environment.

Frontier verdict — High

This is a critical supply chain compromise requiring immediate isolation, credential rotation, and system rebuilds for any affected npm environment.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.