Supply chain · npm · High

CRITICAL: Malicious 'type-atob' npm package compromises systems

Threat Engine Auto-Feed · data current as of 2026-07-12

A critical vulnerability exists in the 'type-atob' npm package, version 3.3.7, which can lead to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / type-atob
  • Affected versions: = 3.3.7
  • Severity: critical
  • Reach: ~312/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'type-atob' npm package, specifically version 3.3.7, has been identified as malicious. Installation of this package results in the full compromise of the host system.

How the attack works

This is a supply-chain attack where a malicious version of a software package is introduced into a public registry. When developers or automated systems install this specific version, the embedded malicious code executes, leading to unauthorized access and control over the compromised system. The attack vector is the installation of the compromised package itself.

Who's exposed

Profiles most at risk

  • Development teams using npm for package management
  • CI/CD pipelines that pull dependencies from npm
  • Organizations with applications relying on 'type-atob' as a direct or transitive dependency

Conditions that increase exposure

  • Projects with unpinned dependencies that could resolve to 'type-atob@3.3.7'
  • Build systems that do not use lockfiles or have outdated lockfiles
  • Internal package mirrors that have synchronized the malicious version
  • Developers who manually installed the specific malicious version

Blast-radius scenarios

  • An attacker gains full control over the compromised computer, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets and keys stored on the compromised system are exposed and can be stolen by the attacker.
  • The blast radius extends to any system that has installed the malicious package, including developer workstations, build servers, and potentially production environments if the package was deployed.

What to do (defensive)

Detect

  • Scan project dependency trees for 'type-atob@3.3.7' using dependency analysis tools.
  • Review npm lockfiles (package-lock.json) to identify the presence of the malicious version.
  • Monitor network traffic for unusual outbound connections from systems that have installed npm packages.

Contain

  • Immediately isolate any system identified with 'type-atob@3.3.7' from the network.
  • Block 'type-atob@3.3.7' from being downloaded from internal package registries or proxies.
  • Temporarily halt builds and deployments that rely on npm packages until all dependencies are verified.

Remediate

  • Consider any system that installed 'type-atob@3.3.7' to be fully compromised; re-image or rebuild from a trusted source.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from compromised systems, doing so from a different, trusted computer.
  • Remove the 'type-atob' package from all affected projects and ensure a safe version (if available) or an alternative is used. Verify that all dependencies are pinned to known-good versions.

Frontier verdict — High

Prioritize immediate system isolation and credential rotation for any environment that installed 'type-atob@3.3.7' due to critical compromise risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.