Supply chain · npm · High

Critical Malicious npm Package 'sams-text-style' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-09-09

A critical malicious package, 'sams-text-style', has been identified in the npm ecosystem. Its installation leads to full system compromise, necessitating immediate secret rotation and thorough remediation due to potential persistent access.

  • Package: npm / sams-text-style
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~7/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'sams-text-style' contains malware. Any system where this package has been installed or executed should be considered fully compromised, with potential for an external entity to gain complete control.

How the attack works

This is a malicious package attack where a seemingly benign software component is introduced into a development or production environment. Upon installation or execution, it performs unauthorized actions, in this case leading to full system compromise and potential credential theft.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm dependencies
  • Any user or system that has directly or indirectly installed 'sams-text-style'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing installation of the latest malicious version
  • Lack of package-lock.json or yarn.lock files to ensure deterministic builds
  • Use of internal mirrors that may not have updated blocklists for malicious packages
  • Automated build processes that fetch and install dependencies without prior vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the network.
  • Persistent malicious software may remain even after the package is removed, making full recovery challenging.

What to do (defensive)

Detect

  • Scan dependency trees for 'sams-text-style' across all projects and environments.
  • Review build logs and package installation histories for any mention of 'sams-text-style'.
  • Monitor network traffic for unusual outbound connections from systems that may have installed the package.

Contain

  • Immediately isolate any system identified with 'sams-text-style' installed.
  • Block 'sams-text-style' from being downloaded or installed by package managers and proxies.
  • Temporarily suspend builds and deployments that rely on npm dependencies until a full audit is complete.

Remediate

  • Consider any system that installed 'sams-text-style' as fully compromised and re-image it from a trusted source.
  • Rotate all secrets, keys, and credentials (e.g., API keys, SSH keys, access tokens) that were stored on or accessible from compromised systems, performing this action from a different, uncompromised computer.
  • Implement strict dependency pinning and use lockfiles (package-lock.json, yarn.lock) to ensure deterministic and secure dependency resolution.
  • Enhance supply chain security practices, including dependency vetting and integrity checks.

Frontier verdict — High

This is a critical severity incident requiring immediate isolation, re-imaging, and comprehensive secret rotation due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.