Malicious code in newtun (npm)
The newtun npm package contained malicious code that established a reverse shell connection to a hardcoded remote server (pull.7ii.win:7999), granting complete remote code execution and file system access to the attacker. The package exfiltrated system information and credentials while allowing arbitrary command execution and file manipulation.
- Disclosed
- Last updated
- Blast radius
- Global npm registry; any system with newtun installed globally or as a dependency
- Ecosystems
- Attack vectors
- Affected entities
- newtunnpm package with malicious code
The newtun npm package was compromised with malicious code that created a persistent backdoor on infected systems. Upon installation or execution, the package opened an unencrypted WebSocket connection to a hardcoded command-and-control server at pull.7ii.win:7999.
The malicious code implemented multiple attack capabilities: it spawned interactive PTY shells on demand via TERM_OPEN messages, executed arbitrary shell commands through SCRIPT_LIST/POLICY_SCRIPTS messages, and performed unrestricted file system operations (read, write, delete, rename, mkdir) via FILE_REQUEST messages. File contents were exfiltrated base64-encoded with a 10MB per-read limit, enabling theft of sensitive credentials from ~/.ssh and ~/.aws directories.
The package also performed continuous system reconnaissance, sending MONITOR frames every 5 seconds containing hostname, OS details, architecture, Node version, CPU/memory/load metrics, uptime, and network statistics. An UPGRADE control message allowed the remote operator to force automatic updates and binary replacement without user interaction.
The incident was identified by Amazon Inspector and disclosed via GitHub Security Advisory GHSA-3xv7-433h-78x9 on 2026-08-11.
Indicators of compromise
- Packages
- newtun
- Domains
- pull.7ii.win
Remediation
- Immediately uninstall newtun from all systems: npm uninstall -g newtun and npm uninstall newtun from affected projects
- Audit all systems that had newtun installed for signs of compromise, including checking ~/.ssh and ~/.aws for unauthorized access or modifications
- Review system logs and network traffic for connections to pull.7ii.win:7999 or related C2 infrastructure
- Rotate all credentials (SSH keys, AWS credentials, API tokens) that may have been exposed on affected systems
- Verify the integrity of any files modified or created while newtun was installed
- Update npm dependencies and rebuild projects to ensure no malicious versions are pinned
- Monitor for any unauthorized changes to global npm packages or system binaries
Sources
- GitHub Advisory GHSA-3xv7-433h-78x9 · GitHub Advisory Database
Cite this entry
"Malicious code in newtun (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-newtun-npm-1vldax
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit