Malicious code in tempo-components (npm)
The npm package tempo-components contained malicious code (poc.js) that collected host metadata and identity information and exfiltrated it to an external endpoint. The package performed system reconnaissance by capturing hostname, platform, and user identity before transmitting the data via HTTPS.
- Disclosed
- Last updated
- Blast radius
- Any developer or build system that installed or loaded the malicious tempo-components package
- Ecosystems
- Attack vectors
- Affected entities
- tempo-componentsnpm package containing malicious code
The npm package tempo-components was found to contain malicious code in a file named poc.js. The malicious code imported Node.js modules for system interaction (os, https, fs, child_process) and performed host reconnaissance by collecting system identifiers including os.hostname(), os.platform(), and the output of the whoami command.\n\nThe collected host metadata and identity information was then exfiltrated by sending an HTTPS POST request to an external endpoint controlled by the attacker. This behavior represents a classic system-reconnaissance and data-exfiltration attack pattern with no legitimate purpose for a package distributed under a 'components' name.\n\nInstallation or loading of this package on a developer machine or build system would result in sensitive host metadata and identity information being transmitted off-host to an attacker-controlled server. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- tempo-components
Remediation
- Immediately remove the tempo-components package from all development and build environments
- Audit all systems where tempo-components was installed for unauthorized access or data exfiltration
- Review network logs for suspicious HTTPS connections to external endpoints from affected machines
- Rotate credentials and SSH keys on any machines that had the package installed
- Use only verified, trusted versions of tempo-components from the npm registry going forward
- Implement package scanning and verification in your build pipeline to detect malicious code
Sources
- GitHub Advisory GHSA-2c5c-pg2w-83fp · GitHub Advisory Database
Cite this entry
"Malicious code in tempo-components (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-tempo-components-npm-1qw77o
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in edu-npm-dependency-chain-demo
Malware discovered in the npm package edu-npm-dependency-chain-demo. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in roblox-api-client
Malware was discovered in the npm package roblox-api-client, resulting in full system compromise for any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in jextic-eclib
Malware was discovered in the npm package jextic-eclib, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @thone33/analytics-injector
Malware discovered in the npm package @thone33/analytics-injector. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package