Malicious code in num-format-helper (npm)
The npm package num-format-helper version 1.0.0 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with domains associated with malicious activity and executes commands associated with malicious behavior.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed num-format-helper version 1.0.0
- Ecosystems
- Attack vectors
- Affected entities
- num-format-helper · 1.0.0
The OpenSSF Package Analysis project identified num-format-helper version 1.0.0 on npm as containing malicious code. The analysis revealed two key indicators of compromise: the package communicates with a domain associated with malicious activity, and it executes one or more commands associated with malicious behavior.\n\nThis finding was published on July 28, 2026, and credited to the OpenSSF malicious-packages repository. The malicious package was assigned identifier MAL-2026-11107.\n\nAny user who installed num-format-helper version 1.0.0 from npm may have been affected by this malicious code.
Indicators of compromise
- Packages
- num-format-helper@1.0.0
Remediation
- Immediately uninstall num-format-helper version 1.0.0 from all systems
- Audit systems that had this package installed for signs of compromise, including unauthorized network connections and command execution
- Review npm package dependencies to ensure no other malicious packages are present
- Update to a safe version if a legitimate replacement is available, or remove the dependency entirely
- Monitor for any suspicious activity on systems that may have executed the malicious code
Sources
- GitHub Advisory GHSA-jf75-cqhp-mhch · GitHub Advisory Database
Cite this entry
"Malicious code in num-format-helper (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-num-format-helper-npm-2ih9hn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package