Malware in hrb-cas-auth-js
Malware was discovered in the npm package hrb-cas-auth-js. The package is considered to provide full system compromise to any computer where it is installed or running.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- hrb-cas-auth-js
A critical malware incident was identified in the npm package hrb-cas-auth-js, published via GitHub Advisory GHSA-fvhw-928m-gxmw on June 29, 2026.\n\nAccording to the advisory, any computer with this package installed or running should be considered fully compromised. The malware grants outside entities potential full control of affected systems.\n\nImmediate remediation steps include: removing the package from all systems, rotating all secrets and keys from a different, uncompromised computer, and conducting a full security audit of affected systems. However, due to the severity of the compromise, there is no guarantee that package removal will eliminate all malicious software that may have been installed.\n\nUsers should assume complete system compromise and take appropriate incident response measures.
Indicators of compromise
- Packages
- hrb-cas-auth-js
Remediation
- Remove the hrb-cas-auth-js package from all affected systems immediately
- Rotate all secrets, keys, and credentials from a different, uncompromised computer
- Conduct a full security audit and forensic analysis of any system that had the package installed
- Monitor affected systems for signs of persistent malware or unauthorized access
- Review all system logs and network traffic from the period when the package was installed
- Consider full system reimaging if compromise is confirmed
Sources
- GitHub Advisory GHSA-fvhw-928m-gxmw · GitHub Advisory Database
Cite this entry
"Malware in hrb-cas-auth-js." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 29, 2026; last updated June 29, 2026. https://supplychainattack.org/incident/malware-in-hrb-cas-auth-js-vks6ab
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in testingsmthb1g (npm)
The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.
npmCompromised package - resolvedcritical
Malicious code in mutex-core (npm)
The npm package mutex-core, published under a name resembling the popular async-mutex library, contained malicious code including a staged loader that decrypts and executes hidden payloads. The package included obfuscated code that conditionally triggers AES-256-GCM decryption and execution of encrypted binary content when specific conditions are met.
npmCompromised package - containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit