Supply chain · npm · High

Critical: Malicious 'app-data-ist' npm Package Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-24

A malicious npm package, 'app-data-ist', has been identified as a critical supply-chain threat. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation efforts.

  • Package: npm / app-data-ist
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~207/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'app-data-ist' contains malware. Any system where this package has been installed or executed should be considered fully compromised, with potential for an external entity to gain complete control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the malware executes, establishing persistence and granting an attacker unauthorized access and control over the compromised system. This class of attack often targets credentials and sensitive data.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any user or system that has directly or transitively installed 'app-data-ist'

Conditions that increase exposure

  • Unpinned dependency versions in package.json (e.g., using '^' or '~' without a lockfile)
  • Lack of dependency lockfiles (e.g., package-lock.json, yarn.lock) in repositories
  • Internal package mirrors or caches that have ingested the malicious package
  • Automated build processes that do not vet new package versions

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the affected computer are exposed and potentially exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the network.
  • Sensitive data on the system could be accessed, modified, or exfiltrated.

What to do (defensive)

Detect

  • Scan dependency trees for 'app-data-ist' across all projects and environments.
  • Review package-lock.json or yarn.lock files for unexpected entries or changes.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.
  • Check system logs for suspicious process execution or file modifications.

Contain

  • Immediately isolate any system identified with 'app-data-ist' installed from the network.
  • Block 'app-data-ist' from being downloaded or installed from package registries.
  • Suspend all CI/CD pipelines that might pull this package until remediation is complete.

Remediate

  • Consider any compromised system as fully compromised and rebuild from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, doing so from a different, trusted computer.
  • Remove the 'app-data-ist' package, but acknowledge that this alone may not remove all malicious software.
  • Implement strict dependency pinning and enforce the use of lockfiles across all projects.
  • Review and strengthen software supply chain security practices, including dependency vetting and integrity checks.

Frontier verdict — High

Prioritize immediate detection and remediation of 'app-data-ist' due to critical severity and full system compromise risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.