Supply chain · npm · High

Critical Malicious npm Package 'js-client-node' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-30

A critical vulnerability has been identified in the npm package 'js-client-node', which, if installed, fully compromises the host system. This package poses a significant risk of credential and secret theft, requiring immediate rotation of all secrets and keys.

  • Package: npm / js-client-node
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~19/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'js-client-node' has been identified as malicious. Any system where this package is installed or executed should be considered fully compromised, with potential for an outside entity to gain full control.

How the attack works

This is a malicious package attack where the installation of 'js-client-node' introduces unauthorized code onto the system. This code is designed to compromise the host, likely enabling credential and secret theft by an attacker.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has 'js-client-node' as a dependency

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing arbitrary version updates
  • Lack of package-lock.json or yarn.lock files to ensure deterministic builds
  • Internal package mirrors that do not vet upstream packages
  • Automated build systems that fetch the latest versions of dependencies

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan project dependencies for 'js-client-node' using 'npm list' or dependency scanning tools.
  • Monitor network traffic for unusual outbound connections from systems that might have installed this package.
  • Review system logs for suspicious activity on machines that recently installed npm packages.

Contain

  • Immediately isolate any system identified with 'js-client-node' installed from the network.
  • Block 'js-client-node' from being downloaded or installed in your environment using package registries or firewalls.
  • Suspend all CI/CD pipelines that might be pulling this package.

Remediate

  • Consider any system that installed 'js-client-node' fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (API keys, credentials, tokens) that were stored on the compromised computer, performing this action from a different, trusted machine.
  • Remove the 'js-client-node' package, but be aware that full compromise means removal alone may not eliminate all malicious software.

Frontier verdict — High

Prioritize immediate investigation and remediation for any system that installed 'js-client-node' due to critical system compromise and credential theft risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.