Supply chain · npm · Critical

Critical npm Package 'common-tg-service' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-08

The npm package 'common-tg-service' has been identified as malicious, leading to full system compromise upon installation. This poses a critical supply-chain risk, requiring immediate action to prevent credential theft and further malicious activity.

  • Package: npm / common-tg-service
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~31,394/wk
  • Exposure: 90/100 (Critical)

What happened — Credential / secret theft

The 'common-tg-service' npm package contains malware. Any system where this package is installed or executed should be considered fully compromised, indicating a severe breach of integrity and confidentiality.

How the attack works

This attack leverages a malicious software package introduced into the software supply chain. When the compromised package is installed as a dependency, it executes unauthorized code, granting an external entity full control over the affected system. This enables credential and secret theft, among other malicious actions.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'common-tg-service'

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to malicious versions
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal package mirrors that may not have updated advisories or block malicious packages

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets and keys stored on the compromised computer are at risk of theft, enabling broader access to sensitive systems and accounts.
  • The integrity of development environments and production systems is severely compromised, requiring extensive remediation efforts.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of 'common-tg-service' in any version.
  • Review build logs and package installation histories for 'common-tg-service'.
  • Monitor network traffic for unusual outbound connections from systems that might have installed this package.

Contain

  • Immediately isolate any system identified with 'common-tg-service' installed.
  • Block 'common-tg-service' from being downloaded or installed in your environment through package managers or proxies.
  • Suspend CI/CD pipelines that might pull this package until remediation is complete.

Remediate

  • Consider any system that installed 'common-tg-service' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from compromised systems, using a different, uncompromised machine.
  • Remove the 'common-tg-service' package from all affected systems, understanding that full control may have been ceded, and further malicious software might persist.

Frontier verdict — Critical

Prioritize immediate detection and isolation of 'common-tg-service' due to critical system compromise and credential theft risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.