Supply chain · npm · High

Critical Supply-Chain Alert: Malicious 'graphql-js-client-transform' npm Package

Threat Engine Auto-Feed · data current as of 2026-09-09

A malicious npm package, 'graphql-js-client-transform', has been identified as a critical supply-chain threat. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation due to potential persistent access.

  • Package: npm / graphql-js-client-transform
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~7/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The 'graphql-js-client-transform' npm package contains malware. Any system where this package has been installed or executed should be considered fully compromised, indicating an attacker has gained unauthorized access and control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is distributed containing harmful code. Upon installation, the malicious code executes, compromising the host system. This type of attack often aims to establish persistence, exfiltrate data, or enable further malicious activities.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any user or system that has directly or indirectly installed 'graphql-js-client-transform'

Conditions that increase exposure

  • Unpinned dependency versions in package.json (e.g., using '*' or '^' for 'graphql-js-client-transform')
  • Lack of package-lock.json or yarn.lock files to ensure deterministic builds
  • Use of internal package mirrors that do not vet upstream packages
  • Automated build processes that install new or updated dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, lateral movement within the network, or deployment of additional malware.
  • All secrets and keys stored on the compromised computer are exposed and can be used by the attacker.
  • The blast radius extends to any systems or services that rely on credentials or data from the compromised machine.

What to do (defensive)

Detect

  • Scan project dependencies for 'graphql-js-client-transform' using package managers or security tools.
  • Monitor system logs for unusual network activity or process execution on machines where the package might have been installed.
  • Review package-lock.json or yarn.lock files for unexpected entries or modifications.

Contain

  • Immediately isolate any systems identified with 'graphql-js-client-transform' from the network.
  • Block network access for compromised systems to prevent further communication with attacker infrastructure.
  • Suspend any CI/CD pipelines or automated processes that could re-introduce the package.

Remediate

  • Consider any system that installed 'graphql-js-client-transform' as fully compromised and re-image it from a trusted source.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised computer, using a different, clean system.
  • Remove 'graphql-js-client-transform' from all project dependencies and ensure package lock files are updated and committed.
  • Implement stricter dependency management policies, including pinning versions and reviewing new package introductions.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and system remediation due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.