Supply chain · npm · High

Critical npm package 'xnder-sdk-js' compromises systems via supply-chain attack

Threat Engine Auto-Feed · data current as of 2026-07-06

A malicious version of the npm package 'xnder-sdk-js' (v0.1.0) has been identified, leading to full system compromise upon installation. This poses a critical supply-chain risk, necessitating immediate action to protect sensitive data and infrastructure.

  • Package: npm / xnder-sdk-js
  • Affected versions: = 0.1.0
  • Severity: critical
  • Reach: ~50/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'xnder-sdk-js' version 0.1.0 contains malware. Installation of this specific version results in the complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package injection attack. An attacker publishes a seemingly legitimate package or a malicious version of an existing one to a public registry. When developers or automated systems install this package, the embedded malicious code executes, compromising the system. In this instance, the compromise is severe, leading to full control by an attacker.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull dependencies directly from npm
  • Any team or individual that has installed 'xnder-sdk-js' version 0.1.0

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest or specific vulnerable versions
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency resolution
  • Use of internal mirrors that do not vet packages for known vulnerabilities
  • Automated builds that do not scan newly introduced dependencies

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets, keys, and credentials stored on the compromised computer are at risk of theft and misuse.
  • The integrity of development environments and production systems could be severely undermined, impacting trust and operational continuity.

What to do (defensive)

Detect

  • Scan all project dependencies for 'xnder-sdk-js' version 0.1.0.
  • Review package-lock.json or yarn.lock files for the presence of the malicious version.
  • Monitor network traffic for unusual outbound connections from systems that installed this package.
  • Implement software composition analysis (SCA) tools to identify known vulnerable or malicious packages in your dependency tree.

Contain

  • Immediately isolate any system identified with 'xnder-sdk-js' version 0.1.0 installed.
  • Block network access for compromised systems to prevent further communication with attacker infrastructure.
  • Prevent new installations of 'xnder-sdk-js' version 0.1.0 across all development and production environments.

Remediate

  • Consider any system that installed 'xnder-sdk-js' version 0.1.0 as fully compromised and rebuild from a trusted image.
  • Rotate all secrets and keys (API keys, credentials, SSH keys, tokens) that were stored on or accessible from the compromised computer, using a different, clean system.
  • Remove the malicious package from all affected environments; however, be aware that this may not fully remove all malicious software due to the nature of the compromise.
  • Implement strict dependency pinning and lockfile usage to prevent accidental installation of malicious versions in the future.

Frontier verdict — High

Prioritize immediate detection, isolation, and complete remediation for any system exposed to 'xnder-sdk-js' v0.1.0 due to critical system compromise and credential theft risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.