Malware in fetch-runtime
Malware was discovered in the npm package fetch-runtime. Any system with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
- Disclosed
- Last updated
- Blast radius
- Any system with fetch-runtime installed or running
- Ecosystems
- Attack vectors
- Affected entities
- fetch-runtime
The npm package fetch-runtime was found to contain malware. According to the GitHub Advisory (GHSA-3hqj-592v-g33j), any computer that has this package installed or running should be considered fully compromised.\n\nImmediate action is required: all secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the compromise.\n\nThis represents a critical supply chain attack through a compromised package in the npm ecosystem.
Indicators of compromise
- Packages
- fetch-runtime
Remediation
- Immediately rotate all secrets and keys from a different, uncompromised computer
- Remove the fetch-runtime package from all affected systems
- Audit system logs for unauthorized access or activity during the period the package was installed
- Scan affected systems for additional malware or persistence mechanisms
- Review and revoke any credentials or API keys that may have been exposed
- Monitor affected systems for suspicious activity even after package removal
Sources
- GitHub Advisory GHSA-3hqj-592v-g33j · GitHub Advisory Database
Cite this entry
"Malware in fetch-runtime." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malware-in-fetch-runtime-wi0ss0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in alphazone
The npm package alphazone contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in core-tailwindcss-utility (npm)
core-tailwindcss-utility, an npm package falsely advertised as a Tailwind CSS utility, contains malicious code that fetches and executes arbitrary Node.js code from a remote C2 server. The package includes suspicious dependencies for credential theft and remote communication.
npmCompromised package - activecritical
Malware in checkout-create-pos-order-am
Malware discovered in the npm package checkout-create-pos-order-am. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package