Malware in kuaishou
The npm package kuaishou was found to contain malware that grants full system compromise to attackers. Any system with this package installed should be considered fully compromised and all credentials rotated immediately from a different machine.
- Disclosed
- Last updated
- Blast radius
- Any system with the malicious package installed
- Ecosystems
- Attack vectors
- Affected entities
- kuaishounpm package containing malware
The npm package kuaishou was identified as containing malware by GitHub Security Advisory GHSA-hwmq-4g98-3x4p. The malicious package grants attackers full control of any computer on which it is installed or running.\n\nAccording to the advisory, systems with this package installed should be considered fully compromised. All secrets and cryptographic keys stored on affected computers must be rotated immediately from a different, uncompromised system. While the package should be removed, complete remediation cannot be guaranteed due to the potential for additional malicious software to have been installed during the compromise.\n\nThe advisory was published on July 13, 2026 via the GitHub Security Advisory database.
Indicators of compromise
- Packages
- kuaishou
Remediation
- Immediately remove the kuaishou package from all systems
- Rotate all secrets, API keys, and cryptographic credentials from a different, uncompromised computer
- Perform a full security audit and malware scan of any system that had the package installed
- Review system logs and network traffic for signs of unauthorized access or data exfiltration
- Consider the affected system(s) as potentially fully compromised and plan for complete reimaging if critical systems are involved
Sources
- GitHub Advisory GHSA-hwmq-4g98-3x4p · GitHub Advisory Database
Cite this entry
"Malware in kuaishou." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 13, 2026; last updated July 13, 2026. https://supplychainattack.org/incident/malware-in-kuaishou-itbj1l
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @flex-ng/filter-pipe
Malware discovered in the npm package @flex-ng/filter-pipe. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in @idms-corp/auth-ui
Malware discovered in the npm package @idms-corp/auth-ui. Systems with this package installed are considered fully compromised, with potential for complete system takeover.
npmCompromised package - resolvedcritical
Malware in @oliviamcdaniel12/safer-buffer
Malware was discovered in the npm package @oliviamcdaniel12/safer-buffer. Any computer with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different system.
npmCompromised package - activecritical
Malware in salesforce-vscode-slds
Malware was discovered in the npm package salesforce-vscode-slds. Any system with this package installed is considered fully compromised and poses a critical risk to stored secrets and keys.
npmCompromised package