Malware in google-caja-bower
Malware was discovered in the npm package google-caja-bower. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- google-caja-bowernpm package containing malware
The npm package google-caja-bower was found to contain malware. According to the GitHub Advisory (GHSA-qq75-mfwc-v6gx), any computer with this package installed or running should be considered fully compromised.\n\nImmediate action is required: all secrets and keys stored on affected computers should be rotated from a different, uncompromised system. The package should be removed, though full removal of all malicious artifacts cannot be guaranteed given the potential for complete system compromise.\n\nThe advisory emphasizes that the scope of compromise is severe, as the malware may have granted outside entities full control of affected systems.
Indicators of compromise
- Packages
- google-caja-bower
Remediation
- Immediately remove the google-caja-bower package from all systems
- Rotate all secrets, API keys, and credentials from a different, uncompromised computer
- Perform a full security audit and malware scan of affected systems
- Review system logs and network traffic for signs of unauthorized access or data exfiltration
- Consider full system reimaging if complete compromise is suspected
- Monitor for any persistence mechanisms or backdoors that may remain after package removal
Sources
- GitHub Advisory GHSA-qq75-mfwc-v6gx · GitHub Advisory Database
Cite this entry
"Malware in google-caja-bower." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 13, 2026; last updated July 13, 2026. https://supplychainattack.org/incident/malware-in-google-caja-bower-1kwdxu
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @logdna-web/styles
Malware was discovered in the npm package @logdna-web/styles. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in @flex-ng/filter-pipe
Malware discovered in the npm package @flex-ng/filter-pipe. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in @idms-corp/auth-ui
Malware discovered in the npm package @idms-corp/auth-ui. Systems with this package installed are considered fully compromised, with potential for complete system takeover.
npmCompromised package - activecritical
Malware in salesforce-vscode-slds
Malware was discovered in the npm package salesforce-vscode-slds. Any system with this package installed is considered fully compromised and poses a critical risk to stored secrets and keys.
npmCompromised package