Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in f-termx (npm)

The npm package f-termx contained malicious code that exposed a remote command execution vulnerability through an unauthenticated HTTP/Socket.IO server. The package spawned shell and SSH proxy handlers with hardcoded default credentials and no authentication gates, allowing any network peer to execute arbitrary commands on the operator's machine.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or operator who installed and ran the f-termx package would have their machine exposed to remote command execution via exposed HTTP/Socket.IO server.
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • f-termxnpm package containing malicious code in index.js and src/server.js

The f-termx npm package contained intentionally malicious code designed to provide remote access to infected systems. The package's main entrypoint (index.js) and src/server.js started an HTTP and Socket.IO server bound to 0.0.0.0, intended to be exposed to the public internet via serveo.net or ngrok tunnels.\n\nThe malicious functionality included two primary attack vectors: a spawn-shell Socket.IO message handler that invoked pty.spawn() to start a local /bin/bash PTY and forwarded subsequent shell-input websocket payloads directly into the process, granting full host command execution; and a connect-ssh handler that opened SSH2 sessions to caller-supplied hosts using credentials from environment variables or hardcoded defaults (SSH_HOST, SSH_USERNAME, SSH_PASSWORD).\n\nThe web UI shipped with hardcoded default credentials (admin/admin), and the SSH-proxy Socket.IO namespace had no authentication gate whatsoever. This combination of unauthenticated remote shell access and SSH pivoting capability made the package a complete remote access trojan when installed and executed.\n\nThe malicious package was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository.

Indicators of compromise

Packages
  • f-termx

Remediation

  • Immediately uninstall the f-termx package from all systems where it was installed
  • Audit npm package.json files and lock files to identify any installations of f-termx
  • Assume any machine that ran f-termx has been compromised; perform full security audit and credential rotation
  • Review network logs for any suspicious Socket.IO connections or shell command execution during the period the package was installed
  • Update npm dependencies and use npm audit to identify any other malicious or vulnerable packages
  • Consider using npm package signing verification and supply chain security tools to prevent similar incidents

Sources

  1. GitHub Advisory GHSA-w84w-x8rw-85h4 · GitHub Advisory Database

Cite this entry

"Malicious code in f-termx (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-f-termx-npm-6dhpbj

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in @syncraft-labs/vue (npm)

    The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.

    npmCompromised package
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. activecritical

    Malware in @sdgdfgdfhhhfd/multiviewr

    Malware discovered in the npm package @sdgdfgdfhhhfd/multiviewr. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package
  4. containedcritical

    Malicious code in 3-buildsight-web (npm)

    The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.

    npmCompromised package