Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in toll_free (npm)

The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All npm users who installed toll_free version 1.0.1
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • toll_free · 1.0.1

The OpenSSF Package Analysis project identified toll_free version 1.0.1 on npm as a malicious package. The malicious behavior was confirmed through analysis of the package code, which executes one or more commands associated with malicious activity.\n\nThe package was cataloged in the OpenSSF's malicious-packages repository under identifier MAL-2026-11159. This finding was published via GitHub Security Advisory GHSA-8grw-9ghp-8r94 on July 29, 2026.\n\nAny user who installed toll_free version 1.0.1 may have been affected by the malicious code execution.

Indicators of compromise

Packages
  • toll_free@1.0.1

Remediation

  • Remove toll_free version 1.0.1 from all environments
  • Audit systems where toll_free 1.0.1 was installed for signs of compromise
  • Review package.json and lock files to identify affected installations
  • Use npm audit to identify toll_free as a malicious dependency
  • Do not install toll_free from npm until the package is removed or verified as safe

Sources

  1. GitHub Advisory GHSA-8grw-9ghp-8r94 · GitHub Advisory Database

Cite this entry

"Malicious code in toll_free (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 29, 2026; last updated July 29, 2026. https://supplychainattack.org/incident/malicious-code-in-toll-free-npm-18okef

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. activecritical

    Malware in @omniwatch-wick/cli

    Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package
  2. activecritical

    Malware in chain-manager

    Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.

    npmCompromised package
  3. containedcritical

    Malicious code in blots (npm)

    The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.

    npmCompromised package
  4. activecritical

    Malware in chain-analyze

    Malware discovered in the npm package chain-analyze. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.

    npmCompromised package