Supply chain · npm · High

Critical Malicious npm Package 'angular2-tesla-common' Poses Full System Compromise Risk

Threat Engine Auto-Feed · data current as of 2026-08-14

A malicious version of the npm package 'angular2-tesla-common' has been identified, leading to full system compromise upon installation. This package is designed for credential and secret theft, requiring immediate action for any affected systems to prevent further unauthorized access and data exfiltration.

  • Package: npm / angular2-tesla-common
  • Affected versions: = 999999999.9999999999.9999999999
  • Severity: critical
  • Reach: ~68/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'angular2-tesla-common' at version 999999999.9999999999.9999999999 contains malware. Installation of this specific version results in a full compromise of the host system, enabling credential and secret theft.

How the attack works

This is a supply-chain attack where a legitimate-looking software package is injected with malicious code. When the compromised package is installed as a dependency, it executes its payload, which in this case aims to steal credentials and secrets from the affected system. The nature of the compromise suggests persistent access may be established.

Who's exposed

Profiles most at risk

  • Development teams using npm for their projects, particularly those with dependencies on 'angular2-tesla-common'.
  • CI/CD pipelines that automatically pull the latest or unpinned versions of dependencies.
  • Organizations with internal package mirrors that may have cached the malicious version.

Conditions that increase exposure

  • Projects with unpinned dependencies that could inadvertently pull the malicious version.
  • Lack of lockfiles (e.g., package-lock.json) that fix dependency versions.
  • Automated build systems configured to install dependencies without strict version constraints.
  • Any system where 'angular2-tesla-common@999999999.9999999999.9999999999' was installed.

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the system are exfiltrated.
  • Potential for lateral movement within the network if the compromised system has access to other resources.
  • Installation of additional malicious software, making remediation complex.

What to do (defensive)

Detect

  • Scan project dependency trees for 'angular2-tesla-common' at version 999999999.9999999999.9999999999.
  • Review package-lock.json or yarn.lock files for the presence of the malicious version.
  • Monitor network traffic for unusual outbound connections from systems where the package might have been installed.
  • Check system logs for suspicious process execution or file modifications post-installation.

Contain

  • Immediately isolate any system identified with the malicious package installed.
  • Block network access for compromised systems to prevent further data exfiltration or command and control communications.
  • Suspend any CI/CD pipelines that might be pulling this dependency.
  • Remove the malicious package from all affected environments, though this alone may not fully remove all malicious components.

Remediate

  • Consider any system that installed the malicious package to be fully compromised and rebuild from a trusted image.
  • Rotate all secrets and keys (API keys, SSH keys, credentials, tokens) that were stored on or accessible from the compromised system, performing this action from a different, trusted computer.
  • Implement strict dependency version pinning (e.g., using lockfiles) in all projects.
  • Review and enhance supply chain security practices, including dependency auditing and integrity checks.

Frontier verdict — High

Prioritize immediate isolation and full remediation for any system that installed 'angular2-tesla-common@999999999.9999999999.9999999999' due to critical system compromise and credential theft risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.