Supply chain · npm · High

Critical Malicious npm Package 'api-node-utils' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-04

A critical vulnerability has been identified in the npm package 'api-node-utils', affecting all versions. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation due to potential persistent malicious software.

  • Package: npm / api-node-utils
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~66/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'api-node-utils' has been identified as malicious. Any system where this package has been installed or executed should be considered fully compromised, with an outside entity potentially gaining complete control.

How the attack works

This is a malicious package attack where the act of installing the 'api-node-utils' package introduces harmful code into the system. This type of compromise can lead to unauthorized access and control over the affected machine, often targeting sensitive data like credentials and secrets.

Who's exposed

Profiles most at risk

  • Development teams using npm for their projects
  • Organizations with CI/CD pipelines that automatically pull dependencies
  • Any user or system that has 'api-node-utils' listed as a dependency in their package.json

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest (malicious) version of 'api-node-utils'
  • Lack of package lockfiles (e.g., package-lock.json) that ensure consistent dependency versions
  • Use of internal mirrors or caches that may have ingested the malicious package
  • Automated build processes that install dependencies without prior security vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised computer, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets and keys stored on the compromised machine are at risk of theft, requiring immediate rotation to prevent unauthorized access to other systems or services.
  • The integrity of development environments and build artifacts is compromised, potentially introducing backdoors into legitimate software.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of 'api-node-utils' in any version.
  • Review package-lock.json or yarn.lock files for 'api-node-utils' entries.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system found to have 'api-node-utils' installed from the network.
  • Suspend any CI/CD pipelines or automated processes that could install this package.
  • Block 'api-node-utils' from being downloaded from npm registries or internal mirrors.

Remediate

  • Consider any system that installed 'api-node-utils' as fully compromised and rebuild from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, access tokens) that were stored on or accessible from the compromised computer, using a different, trusted machine.
  • Thoroughly audit all codebases and build artifacts for signs of tampering or persistence mechanisms, as removing the package itself may not fully eliminate the threat.

Frontier verdict — High

Prioritize immediate detection and isolation of systems with 'api-node-utils' due to full compromise and critical credential theft risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.