Supply chain · npm · High

Critical: Malicious 'arc-diag-util' npm Package Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-17

The npm package 'arc-diag-util' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems should be rotated immediately, and the package removed, though full remediation may require further steps due to potential persistent compromise.

  • Package: npm / arc-diag-util
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~104/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'arc-diag-util' npm package contains malware. Installation or execution of this package results in the complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the embedded malware executes, establishing unauthorized access and control over the compromised system. This class of attack often targets sensitive data, system resources, or establishes persistence for future malicious activities.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any user or system that has installed 'arc-diag-util'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing for automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock) to ensure consistent dependency resolution
  • Use of internal package mirrors that do not vet upstream packages for known vulnerabilities or malicious content
  • Automated build processes that do not include dependency integrity checks

Blast-radius scenarios

  • An attacker gains full control over a developer's workstation, potentially accessing source code, credentials, and internal networks.
  • A compromised build server could inject malicious code into production artifacts, leading to widespread compromise of deployed applications.
  • Sensitive data, including API keys, tokens, and personal information, is exfiltrated from affected systems.
  • The attacker establishes persistent access to the compromised environment, enabling long-term espionage or sabotage.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of 'arc-diag-util' across all projects.
  • Review package lockfiles (e.g., package-lock.json) for 'arc-diag-util' entries.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.
  • Check system logs for suspicious process execution or file modifications post-installation of new dependencies.

Contain

  • Immediately isolate any system identified with 'arc-diag-util' installed from the network.
  • Suspend all CI/CD pipelines and builds that might pull this package.
  • Block 'arc-diag-util' at your package registry or proxy to prevent further downloads.
  • Notify all developers and teams about the malicious package and instruct them to cease using it.

Remediate

  • Consider any computer that installed 'arc-diag-util' as fully compromised and re-image it.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, passwords) stored on or accessible from any compromised system, performing this rotation from a known clean machine.
  • Remove 'arc-diag-util' from all project dependencies and update lockfiles.
  • Implement strict dependency pinning and integrity checks in all development and deployment workflows.

Frontier verdict — High

This is a critical severity supply-chain compromise requiring immediate isolation, credential rotation, and system remediation due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.