Malicious code in supership-scan (npm)
The npm package supership-scan contains malicious code that exfiltrates source code and environment files (including .env files with secrets) to an attacker-controlled endpoint (https://supership.crestsystems.ai/scan/), despite marketing claims that code never leaves the machine. The package is particularly dangerous when used as an MCP server with AI coding agents.
- Disclosed
- Last updated
- Blast radius
- Users of supership-scan npm package, particularly those using it as an MCP server with AI coding agents (Claude Code, Cursor, Windsurf); any repository scanned with this tool risks exposure of source code and secrets.
- Ecosystems
- Attack vectors
- Affected entities
- supership-scannpm package advertised as local-only static analyzer but exfiltrates code and secrets to attacker-controlled endpoint
The supership-scan npm package is advertised as a local-only static analyzer with claims that "Your code never leaves the machine" and "source code, file contents" are never transmitted. However, analysis of the actual implementation reveals malicious code in src/cli.mjs and src/server.mjs that contradicts these claims.
The package walks the target directory and reads file contents, explicitly including files whose names start with .env (as seen in cli.mjs line 74). The full file map is then POSTed to https://supership.crestsystems.ai/scan/, an attacker-controlled endpoint. This upload occurs unconditionally across all tiers and the local scanner module is not invoked on the free path.
The MCP server variant exposes scan_directory and scan_code tools to AI coding agents (Claude Code, Cursor, Windsurf). When an agent invokes these tools, the user's entire repository is silently transmitted to the attacker's endpoint without user consent, including production secrets stored in .env, .env.production, and .env.local files (such as DATABASE_URL, API keys, JWT secrets, and cloud credentials).
This represents a canonical silent-relay attack pattern where caller-supplied data flows to an author-controlled destination while marketing claims the opposite.
Indicators of compromise
- Packages
- supership-scan
- Domains
- supership.crestsystems.ai
Remediation
- Immediately uninstall supership-scan from all environments
- Audit any repositories scanned with supership-scan for potential exposure
- Rotate all secrets (API keys, database credentials, JWT secrets, cloud credentials) that may have been exposed
- Review git history and environment files for any sensitive data that may have been exfiltrated
- If using AI coding agents (Claude Code, Cursor, Windsurf), verify no malicious MCP servers are configured
- Use alternative static analysis tools with verified open-source implementations
Sources
- GitHub Advisory GHSA-h4qv-p8p2-5227 · GitHub Advisory Database
Cite this entry
"Malicious code in supership-scan (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-supership-scan-npm-1q2aso
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @antv/g-webgl-compute (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g-webgl-compute, as part of the "Mini Shai-Hulud" supply chain attack campaign. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/g2-ssr (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g2-ssr, in a 22-minute automated burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/g6-extension-3d (npm)
A threat actor compromised the npm account `atool` and published 631 malicious versions across 314 npm packages, including @antv/g6-extension-3d, in a 22-minute automated burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/gi-assets-basic (npm)
A threat actor compromised the npm account 'atool' and published 631 malicious versions across 314 npm packages, including @antv/gi-assets-basic, in an automated 22-minute burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit