Malicious code in @tc-core/campus-service (npm)
The npm package @tc-core/campus-service version 0.0.0-defensive-callback was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected version
- Ecosystems
- Attack vectors
- Affected entities
- @tc-core/campus-service · 0.0.0-defensive-callback
The npm package @tc-core/campus-service was flagged as containing malicious code by multiple security sources. Amazon Inspector identified the malicious package via hash analysis (c58f691cfdb7301c271067776e2e3bc260d4cbb8880345d03e840729d849b580), and the OpenSSF Package Analysis project independently confirmed the finding for version 0.0.0-defensive-callback.\n\nThe malicious behavior was attributed to the package communicating with a domain associated with malicious activity. The advisory was published on 2026-07-27 and credited to the OpenSSF malicious-packages repository.\n\nThe package appears to be contained as it has been identified and flagged in public security advisories, allowing users to detect and remove it.
Indicators of compromise
- Packages
- @tc-core/campus-service@0.0.0-defensive-callback
- Hashes
- c58f691cfdb7301c271067776e2e3bc260d4cbb8880345d03e840729d849b580
- 9bbf1badd9e8d2be29855017cbd2d690f33885c0884c653412d7d4e463656494
Remediation
- Remove @tc-core/campus-service from all projects, particularly version 0.0.0-defensive-callback
- Audit project dependencies to identify any installations of this package
- Review any network activity or data exfiltration that may have occurred while the package was installed
- Use npm audit or similar tools to detect the presence of this malicious package
- Consider rotating any credentials or secrets that may have been exposed
Sources
- GitHub Advisory GHSA-3hvw-w2fc-p2fg · GitHub Advisory Database
Cite this entry
"Malicious code in @tc-core/campus-service (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-tc-core-campus-service-npm-c84td4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @nasddatax/common
Malware was discovered in the npm package @nasddatax/common. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in @voxepay/checkout
The npm package @voxepay/checkout contained malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in @afasinatickets/common
The npm package @afasinatickets/common contains malware that grants full system compromise to an outside entity. All systems with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in simplipayng
Malware was discovered in the npm package simplipayng. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package