Malicious code in exnesss (npm)
The npm package 'exnesss' version 0.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of version 0.0.1
- Ecosystems
- Attack vectors
- Affected entities
- exnesss · 0.0.1
The OpenSSF Package Analysis project identified the npm package 'exnesss' at version 0.0.1 as containing malicious code. The malicious behavior was detected through analysis of the package's network communications.\n\nThe package was found to communicate with a domain associated with malicious activity, indicating potential data exfiltration, command-and-control communication, or similar harmful intent.\n\nThe incident was disclosed on 2026-08-04 and credited to the OpenSSF malicious-packages repository. The affected version is 0.0.1.
Remediation
- Remove exnesss version 0.0.1 from any projects where it is installed
- Audit project dependencies to ensure no versions of exnesss are present
- Review any systems that may have executed code from this package for signs of compromise
- Monitor for suspicious network activity or data exfiltration from affected systems
Sources
- GitHub Advisory GHSA-f7x6-vccr-6v28 · GitHub Advisory Database
Cite this entry
"Malicious code in exnesss (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 4, 2026; last updated August 4, 2026. https://supplychainattack.org/incident/malicious-code-in-exnesss-npm-13flih
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @zzzgenesis00/bip39-generator (npm)
The npm package @zzzgenesis00/bip39-generator version 3.1.2 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.
npmCompromised package - activecritical
Malware in flat-cache
Malware was discovered in the flat-cache npm package. Systems with the package installed or running are considered fully compromised, with potential for complete system takeover and credential theft.
npmCompromised package - containedcritical
Malware in keyv
Malware was discovered in the keyv npm package. Systems with the package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package - activecritical
ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2
ChainDrop is a self-propagating npm worm that publishes malicious versions of dozens of npm packages using stolen maintainer credentials. The worm harvests CI/CD credentials and uses an Ethereum-based dead-drop command-and-control mechanism.
ChaindropnpmOtherCompromised packageMalicious maintainerAccount takeover