Malware in fry-page-maker-types
Malware discovered in the npm package fry-page-maker-types. Systems with this package installed are considered fully compromised and require immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- fry-page-maker-types
A malware incident has been identified in the npm package fry-page-maker-types, as documented in GitHub Advisory GHSA-h63m-5wpm-mh34. Any computer with this package installed or running should be considered fully compromised.\n\nThe advisory recommends that all secrets and keys stored on affected computers be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the package installation, given the potential for full system compromise.\n\nAffected users should treat their systems as potentially under external control and take appropriate security measures accordingly.
Indicators of compromise
- Packages
- fry-page-maker-types
Remediation
- Immediately rotate all secrets and keys from a different, uncompromised computer
- Remove the fry-page-maker-types package from all affected systems
- Conduct a full security audit of any system that had this package installed
- Monitor affected systems for signs of unauthorized access or persistence mechanisms
- Consider rebuilding affected systems from clean media if full compromise is suspected
Sources
- GitHub Advisory GHSA-h63m-5wpm-mh34 · GitHub Advisory Database
Cite this entry
"Malware in fry-page-maker-types." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malware-in-fry-page-maker-types-u9fmx8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package - resolvedcritical
Malicious code in hunterone-build-probe-9210 (npm)
The npm package hunterone-build-probe-9210 contained malicious code that executed automatically via preinstall and postinstall hooks, collecting sensitive system and credential information and exfiltrating it to a third-party webhook endpoint.
npmCompromised package - resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting