Malicious code in @apps-home-dashboard/events (npm)
The npm package @apps-home-dashboard/events version 11.9.1 was found to contain malicious code that communicates with domains associated with malicious activity and executes suspicious commands. The package was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected version
- Ecosystems
- Attack vectors
- Affected entities
- @apps-home-dashboard/events · 11.9.1
The npm package @apps-home-dashboard/events version 11.9.1 was identified as containing malicious code by multiple security sources. Amazon Inspector and the OpenSSF Package Analysis project both flagged the package as malicious.\n\nAccording to the analysis, the malicious package exhibits two key behaviors: it communicates with a domain associated with malicious activity, and it executes one or more commands associated with malicious behavior. This indicates the package was either compromised or intentionally published with malicious intent.\n\nThe incident was disclosed on 2026-07-27 via GitHub Security Advisory GHSA-cjw9-49j6-f3rw and is tracked in the OpenSSF malicious packages repository.
Indicators of compromise
- Packages
- @apps-home-dashboard/events@11.9.1
Remediation
- Remove @apps-home-dashboard/events version 11.9.1 from all environments
- Audit project dependencies to identify any use of the affected package version
- Review and revoke any credentials or secrets that may have been exposed on systems where the malicious package was installed
- Monitor affected systems for signs of compromise or unauthorized activity
- Update to a safe version of the package if available, or use an alternative package
Sources
- GitHub Advisory GHSA-cjw9-49j6-f3rw · GitHub Advisory Database
Cite this entry
"Malicious code in @apps-home-dashboard/events (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-apps-home-dashboard-events-npm-1t7hzt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in edu-npm-dependency-chain-demo
Malware discovered in the npm package edu-npm-dependency-chain-demo. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in roblox-api-client
Malware was discovered in the npm package roblox-api-client, resulting in full system compromise for any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in jextic-eclib
Malware was discovered in the npm package jextic-eclib, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @thone33/analytics-injector
Malware discovered in the npm package @thone33/analytics-injector. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package