Supply chain · npm · High

Critical npm package 'ozturk-mfa' compromises host systems

Threat Engine Auto-Feed · data current as of 2026-08-28

The npm package 'ozturk-mfa' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / ozturk-mfa
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~319/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'ozturk-mfa' contains malware. Installation or execution of this package results in the full compromise of the host computer, potentially granting an external entity complete control.

How the attack works

This is a malicious package attack, where a seemingly legitimate software component from a public registry introduces harmful code into a development or production environment. Upon installation, the embedded malware executes, compromising the integrity and security of the host system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has 'ozturk-mfa' as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned dependencies that automatically update to the latest version
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal package mirrors that may not have been updated to reflect the package's malicious status

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets, keys, and sensitive data stored on the compromised system are exposed.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan dependency trees for 'ozturk-mfa' in all projects.
  • Review build logs and package installation histories for 'ozturk-mfa' presence.
  • Monitor network traffic for anomalous outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system identified with 'ozturk-mfa' installed.
  • Block 'ozturk-mfa' from being downloaded or installed from public or internal package registries.
  • Review and update dependency policies to pin versions and use lockfiles.

Remediate

  • Consider any computer that installed 'ozturk-mfa' to be fully compromised.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on the compromised computer, performing this action from a different, trusted system.
  • Remove the 'ozturk-mfa' package from all affected systems. Due to potential full compromise, a complete system rebuild or restoration from a known good backup should be considered to ensure all malicious software is eradicated.

Frontier verdict — High

Prioritize immediate action due to critical severity and full system compromise risk from 'ozturk-mfa'.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.