Malicious code in exnesss (npm)
The npm package 'exnesss' version 0.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of version 0.0.1
- Ecosystems
- Attack vectors
- Affected entities
- exnesss · 0.0.1
The OpenSSF Package Analysis project identified the npm package 'exnesss' at version 0.0.1 as containing malicious code. The malicious behavior was detected through analysis of the package's network communications.\n\nThe package was found to communicate with a domain associated with malicious activity, indicating potential data exfiltration, command-and-control communication, or similar harmful intent.\n\nThe incident was disclosed on 2026-08-04 and credited to the OpenSSF malicious-packages repository. The affected version is 0.0.1.
Remediation
- Remove exnesss version 0.0.1 from any projects where it is installed
- Audit project dependencies to ensure no versions of exnesss are present
- Review any systems that may have executed code from this package for signs of compromise
- Monitor for suspicious network activity or data exfiltration from affected systems
Sources
- GitHub Advisory GHSA-f7x6-vccr-6v28 · GitHub Advisory Database
Cite this entry
"Malicious code in exnesss (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 4, 2026; last updated August 4, 2026. https://supplychainattack.org/incident/malicious-code-in-exnesss-npm-13flih
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in rdfxvela
Malware was distributed via the npm package rdfxvela, resulting in full system compromise of affected machines. The package should be removed and all secrets and keys rotated from a different computer.
npmCompromised package - containedcritical
Malware in velabuild
The npm package velabuild was found to contain malware, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in trimprompt (npm)
The npm package trimprompt@1.0.47 contains malicious obfuscated code with install-time and load-time execution capabilities, including PowerShell spawning via postinstall hooks and host-reconnaissance/beaconing functionality via child_process and HTTP POST calls.
npmCompromised package - resolvedcritical
Malicious code in @united-airlines-org/atmos-design-system (npm)
The npm package @united-airlines-org/atmos-design-system contains a malicious preinstall script that exfiltrates host reconnaissance data (hostname, directory listing, username) to an attacker-controlled endpoint. The package uses a scope name resembling an internal United Airlines organization, matching a dependency-confusion attack pattern.
npmCompromised packageDependency confusion