Malicious code in tempo-components (npm)
The npm package tempo-components contained malicious code (poc.js) that collected host metadata and identity information and exfiltrated it to an external endpoint. The package performed system reconnaissance by capturing hostname, platform, and user identity before transmitting the data via HTTPS.
- Disclosed
- Last updated
- Blast radius
- Any developer or build system that installed or loaded the malicious tempo-components package
- Ecosystems
- Attack vectors
- Affected entities
- tempo-componentsnpm package containing malicious code
The npm package tempo-components was found to contain malicious code in a file named poc.js. The malicious code imported Node.js modules for system interaction (os, https, fs, child_process) and performed host reconnaissance by collecting system identifiers including os.hostname(), os.platform(), and the output of the whoami command.\n\nThe collected host metadata and identity information was then exfiltrated by sending an HTTPS POST request to an external endpoint controlled by the attacker. This behavior represents a classic system-reconnaissance and data-exfiltration attack pattern with no legitimate purpose for a package distributed under a 'components' name.\n\nInstallation or loading of this package on a developer machine or build system would result in sensitive host metadata and identity information being transmitted off-host to an attacker-controlled server. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- tempo-components
Remediation
- Immediately remove the tempo-components package from all development and build environments
- Audit all systems where tempo-components was installed for unauthorized access or data exfiltration
- Review network logs for suspicious HTTPS connections to external endpoints from affected machines
- Rotate credentials and SSH keys on any machines that had the package installed
- Use only verified, trusted versions of tempo-components from the npm registry going forward
- Implement package scanning and verification in your build pipeline to detect malicious code
Sources
- GitHub Advisory GHSA-2c5c-pg2w-83fp · GitHub Advisory Database
Cite this entry
"Malicious code in tempo-components (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-tempo-components-npm-1qw77o
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in sme-rko-finance-front-operations-feed-models (npm)
The npm package sme-rko-finance-front-operations-feed-models contained malicious code that downloads and executes attacker-controlled native binaries from remote servers upon package load. The malware uses obfuscation techniques including fragmented string arrays, platform-specific endpoints, and DNS TXT record fallbacks to evade detection.
npmCompromised package - resolvedcritical
Malicious code in modern-localization (npm)
The npm package modern-localization contained malicious code that fetches and executes arbitrary JavaScript from a remote jsonbin.io endpoint on server-side require, with no integrity verification. The payload is executed with full Node.js privileges via Function() or child_process.fork().
npmCompromised package - resolvedcritical
Malicious code in sme-rko-finance-front-operations-tax (npm)
The npm package sme-rko-finance-front-operations-tax contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on require. The package was identified and reported by OpenSSF's malicious-packages project.
npmCompromised package - resolvedcritical
Malicious code in localization-fixer (npm)
The npm package localization-fixer contained malicious code that fetches and executes arbitrary JavaScript from attacker-controlled jsonbin.io endpoints on package require, granting full Node.js capabilities to remote payloads.
npmCompromised package