Supply chain · npm · Critical

Critical: Malicious npm package 'pushgitquickx' compromises systems

Threat Engine Auto-Feed · data current as of 2026-08-27

The npm package 'pushgitquickx' version 1.0.0 has been identified as malicious, leading to full system compromise upon installation. This poses a critical supply-chain risk, necessitating immediate action for any systems that have installed it.

  • Package: npm / pushgitquickx
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: ~1,135/wk
  • Exposure: 80/100 (Critical)

What happened — Credential / secret theft

The 'pushgitquickx' npm package, specifically version 1.0.0, contains malware. Installation of this package results in a complete compromise of the host system.

How the attack works

This is a malicious package attack where a seemingly legitimate or useful software component is replaced with or augmented by harmful code. When the package is installed as a dependency, the malicious code executes, potentially establishing persistent access or exfiltrating sensitive data from the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that build projects with npm dependencies
  • Organizations with internal package mirrors that may have cached the malicious version

Conditions that increase exposure

  • Projects with unpinned dependencies that could pull the malicious version
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Automated builds that fetch the latest package versions without review

Blast-radius scenarios

  • An attacker gains full control over the compromised computer
  • All secrets and keys stored on the compromised computer are exposed
  • Potential for lateral movement within the network from the compromised host

What to do (defensive)

Detect

  • Review package-lock.json or yarn.lock files for 'pushgitquickx@1.0.0'
  • Scan dependency trees for 'pushgitquickx' across all projects
  • Monitor network traffic for unusual outbound connections from build systems or developer machines

Contain

  • Immediately isolate any system identified with 'pushgitquickx' installed
  • Block 'pushgitquickx' version 1.0.0 from being pulled from npm registries or internal mirrors
  • Suspend builds that might pull this dependency

Remediate

  • Consider any computer that installed 'pushgitquickx' version 1.0.0 to be fully compromised
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) from a different, trusted computer
  • Rebuild compromised systems from trusted images, as simply removing the package may not fully eliminate the malware

Frontier verdict — Critical

This is a critical supply-chain incident requiring urgent action due to full system compromise and credential theft risk from the 'pushgitquickx' npm package.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.