Malware in avatar-forge
Malware was discovered in the npm package avatar-forge, resulting in full system compromise for any installation. The package should be removed and all secrets and keys rotated from a clean system.
- Disclosed
- Last updated
- Blast radius
- Any system with avatar-forge installed or running
- Ecosystems
- Attack vectors
- Affected entities
- avatar-forge
A critical malware incident was identified in the npm package avatar-forge. According to the GitHub Advisory (GHSA-23h6-jm35-q4x7), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory recommends immediate action: all secrets and keys stored on affected computers should be rotated from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the initial compromise, given that the attacker may have gained full control of the system.\n\nAffected users should treat any system that has run avatar-forge as potentially fully compromised and take appropriate incident response measures.
Indicators of compromise
- Packages
- avatar-forge
Remediation
- Remove the avatar-forge package immediately
- Rotate all secrets, API keys, and credentials from a clean, uncompromised system
- Assume full system compromise and conduct forensic analysis
- Monitor affected systems for signs of persistent malware or unauthorized access
- Review system logs for any suspicious activity during the period avatar-forge was installed
Sources
- GitHub Advisory GHSA-23h6-jm35-q4x7 · GitHub Advisory Database
Cite this entry
"Malware in avatar-forge." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 14, 2026; last updated July 14, 2026. https://supplychainattack.org/incident/malware-in-avatar-forge-hur3kj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @logdna-web/styles
Malware was discovered in the npm package @logdna-web/styles. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in @flex-ng/filter-pipe
Malware discovered in the npm package @flex-ng/filter-pipe. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in @idms-corp/auth-ui
Malware discovered in the npm package @idms-corp/auth-ui. Systems with this package installed are considered fully compromised, with potential for complete system takeover.
npmCompromised package - activecritical
Malware in salesforce-vscode-slds
Malware was discovered in the npm package salesforce-vscode-slds. Any system with this package installed is considered fully compromised and poses a critical risk to stored secrets and keys.
npmCompromised package