Supply chain · npm · High

CRITICAL: Malicious npm package 'loader1' compromises systems

Threat Engine Auto-Feed · data current as of 2026-07-16

The npm package 'loader1' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / loader1
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~262/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'loader1' contains malware that, when installed or run, fully compromises the host computer. This allows an attacker to gain complete control over the system.

How the attack works

This is a malicious package attack where a seemingly legitimate software component, 'loader1', is distributed with hidden malicious code. When a developer or automated system integrates this package into a project and installs it, the malicious code executes, leading to unauthorized access and control over the system.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Organizations with internal package mirrors that have ingested 'loader1'

Conditions that increase exposure

  • Projects with unpinned dependencies that could inadvertently pull 'loader1'
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Automated build systems that do not vet third-party package integrity

Blast-radius scenarios

  • An attacker gains full control of the compromised computer, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets and keys stored on the compromised system are exposed and can be used by the attacker, necessitating immediate rotation.
  • The blast radius extends to any systems that interact with the compromised machine, such as source code repositories, production environments, or other internal services.

What to do (defensive)

Detect

  • Scan dependency trees for 'loader1' in all projects and environments.
  • Monitor network traffic for unusual outbound connections from systems that have 'loader1' installed.
  • Review system logs for suspicious process execution or file modifications on machines that installed 'loader1'.

Contain

  • Immediately isolate any systems identified with 'loader1' installed from the network.
  • Block 'loader1' from being downloaded or installed from all package registries and internal mirrors.
  • Suspend all CI/CD pipelines that might be exposed to 'loader1'.

Remediate

  • Consider any computer with 'loader1' installed as fully compromised; re-image or rebuild the system from a trusted source.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Remove 'loader1' from all projects and ensure dependency versions are explicitly pinned to known good versions.

Frontier verdict — High

Prioritize immediate action due to critical severity and full system compromise risk from npm package 'loader1'.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.