Supply chain · npm · High

Critical npm Package 'veldora' Compromises Systems, Demands Immediate Action

Threat Engine Auto-Feed · data current as of 2026-07-22

The npm package 'veldora' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated, and the package removed, though full remediation may require further steps due to potential persistent compromise.

  • Package: npm / veldora
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~130/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'veldora' contains malware that, upon installation, fully compromises the host system. This grants an external entity control over the affected computer.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is weaponized. When 'veldora' is installed as a dependency, it executes malicious code, leading to unauthorized access and control over the system where it is run. The specific mechanism of compromise is not detailed, but the outcome is full system control for the attacker.

Who's exposed

Profiles most at risk

  • Development teams using npm for package management
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'veldora' directly or as a transitive dependency

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing 'veldora' to be pulled in
  • Lack of package-lock.json or yarn.lock to ensure consistent dependency versions
  • Internal package mirrors that have synchronized the malicious 'veldora' package
  • Automated build processes that install npm packages without prior vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets, keys, and credentials stored on the compromised computer are at risk of theft.
  • The integrity of development environments, build servers, and production systems could be severely compromised.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of 'veldora' (any version).
  • Review package-lock.json or yarn.lock files for 'veldora'.
  • Monitor network traffic for unusual outbound connections from systems that might have installed 'veldora'.
  • Check system logs for suspicious process execution or file modifications post-installation of npm packages.

Contain

  • Immediately isolate any system identified with 'veldora' installed from the network.
  • Suspend any CI/CD pipelines or automated processes that could install 'veldora'.
  • Block 'veldora' from being downloaded from npm registries or internal mirrors.
  • Review and update dependency policies to prevent unvetted packages from being introduced.

Remediate

  • Consider any system that installed 'veldora' to be fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, keys, and credentials that were stored on or accessible from the compromised system, using a different, trusted computer.
  • Remove 'veldora' from all package.json files and ensure lock files are updated to reflect its removal.
  • Conduct a thorough forensic analysis on affected systems to understand the full extent of the compromise, acknowledging that removal of the package itself may not fully eliminate all malicious components.

Frontier verdict — High

This critical npm package compromise requires immediate system isolation, secret rotation, and thorough remediation due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.