Malware in @bikli/cli
Malware was discovered in the npm package @bikli/cli. The package grants full system compromise to attackers and should be considered a critical threat to any system where it has been installed or executed.
- Disclosed
- Last updated
- Blast radius
- Any system with @bikli/cli installed or executed
- Ecosystems
- Attack vectors
- Affected entities
- @bikli/cli
A malware-laden version of the npm package @bikli/cli was identified and published on GitHub's advisory database (GHSA-cc5p-hf7h-rrjh). The package contains malicious code that provides complete system compromise to an outside entity.\n\nAny computer that has installed or executed this package should be considered fully compromised. The advisory recommends immediate rotation of all secrets and keys from a different, unaffected computer. While the package can be removed, full system compromise means there is no guarantee that removal will eliminate all malicious software that may have been installed as a result.\n\nUsers should treat affected systems as potentially fully controlled by attackers and take appropriate incident response measures.
Indicators of compromise
- Packages
- @bikli/cli
Remediation
- Immediately isolate any system that has installed or executed @bikli/cli from the network
- Rotate all secrets, API keys, and credentials from a different, unaffected computer
- Remove the @bikli/cli package from affected systems
- Perform a full forensic analysis and malware scan on affected systems
- Consider the affected system(s) as potentially fully compromised and plan for complete rebuild if critical
- Review access logs and audit trails for any unauthorized activity during the period the package was installed
Sources
- GitHub Advisory GHSA-cc5p-hf7h-rrjh · GitHub Advisory Database
Cite this entry
"Malware in @bikli/cli." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malware-in-bikli-cli-14pn1w
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in pump-segments-sdk (npm)
The npm package pump-segments-sdk contained malicious code in a postinstall hook that exfiltrated sensitive system and npm configuration data to an attacker-controlled server. The package collected hostname, environment variables, system information, npm auth tokens, and attempted to read password hashes.
npmCompromised package - containedcritical
Malicious code in ts-rand-sdk (npm)
The npm package ts-rand-sdk contained malicious code disguised as a product catalog loader. When the advertised getTransactions() API was called, hidden obfuscated JavaScript was decoded and executed with full Node.js capabilities, enabling arbitrary filesystem, process, and network access on affected systems.
npmCompromised package - resolvedcritical
Malicious code in lodsh-cli (npm)
lodsh-cli, a typosquat of lodash-cli on npm, contained malicious code in its postinstall script that executed arbitrary remote code and exfiltrated system information. The package downloaded a Windows executable and sent platform data to a hardcoded IP address.
npmTyposquattingCompromised package - containedcritical
Malicious code in lodahsjs (npm)
The npm package lodahsjs is a typosquatting attack on 'lodash' that contains malicious code in its postinstall script. Upon installation, it exfiltrates system information to a C2 server and downloads and executes a Windows binary, with capability to bridge WSL environments to compromise the host Windows system.
npmCompromised packageTyposquatting