Supply chain · npm · High

Critical npm package 'babel-preset-lib-client' compromises systems

Threat Engine Auto-Feed · data current as of 2026-07-13

A malicious version of the 'babel-preset-lib-client' npm package has been identified, leading to full system compromise upon installation. This poses a critical supply-chain risk, necessitating immediate action to protect sensitive data and infrastructure.

  • Package: npm / babel-preset-lib-client
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: ~749/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The 'babel-preset-lib-client' npm package, version 1.0.0, contains malware. Installation of this specific version results in the complete compromise of the host system.

How the attack works

This is a supply-chain attack where a legitimate-looking software package is trojanized with malicious code. When the package is installed as a dependency, the embedded malware executes, granting an attacker unauthorized access and control over the compromised system. The specific mechanism of compromise is not detailed, but the outcome is full system control.

Who's exposed

Profiles most at risk

  • Development teams using npm for JavaScript projects
  • Organizations with CI/CD pipelines that automatically pull npm packages
  • Any user or system that has installed 'babel-preset-lib-client' version 1.0.0

Conditions that increase exposure

  • Projects with unpinned or broad dependency versions that could resolve to 'babel-preset-lib-client@1.0.0'
  • Lack of dependency lockfiles (e.g., package-lock.json, yarn.lock) or not committing them to version control
  • Using internal package mirrors that do not vet package integrity or have not updated their mirrors to exclude the malicious version
  • Automated build processes that do not scan new dependencies for known vulnerabilities or malicious content

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or deployment of additional malicious software.
  • All secrets and keys stored on the compromised computer are at risk of theft and misuse.
  • The integrity of development environments and build artifacts can be undermined, propagating the compromise further into the software supply chain.

What to do (defensive)

Detect

  • Scan dependency trees for 'babel-preset-lib-client' version 1.0.0.
  • Review package-lock.json or yarn.lock files for the presence of the malicious package.
  • Monitor network traffic for unusual outbound connections from systems that installed the package.
  • Utilize software composition analysis (SCA) tools to identify vulnerable or malicious dependencies.

Contain

  • Immediately isolate any system identified with 'babel-preset-lib-client@1.0.0' installed from the network.
  • Block 'babel-preset-lib-client' version 1.0.0 from being downloaded or installed via package managers or internal registries.
  • Suspend any CI/CD pipelines that might pull this package until remediation is complete.

Remediate

  • Consider any system that installed 'babel-preset-lib-client@1.0.0' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from compromised systems, performing this action from a different, trusted computer.
  • Remove the 'babel-preset-lib-client' package from all projects and ensure dependency resolvers cannot pull version 1.0.0.
  • Implement strict dependency pinning and commit lockfiles to prevent unexpected dependency resolution.

Frontier verdict — High

Prioritize immediate detection and remediation due to full system compromise and credential theft risk from 'babel-preset-lib-client@1.0.0'.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.