Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malware in node-fetch-utils

Malware was discovered in the npm package node-fetch-utils. The package grants full control of affected systems to an outside entity, requiring immediate removal and credential rotation from a clean system.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system with the package installed or running
Ecosystems
Attack vectors
Affected entities
  • node-fetch-utils

The npm package node-fetch-utils was found to contain malware. According to the GitHub Advisory (GHSA-4jfq-h5q8-g7hm), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory recommends that all secrets and keys stored on affected computers be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the compromise.\n\nThis represents a critical supply chain attack through a compromised package in the npm ecosystem, with potential for complete system compromise on any machine where it was installed or executed.

Indicators of compromise

Packages
  • node-fetch-utils

Remediation

  • Immediately remove the node-fetch-utils package from all systems
  • Rotate all secrets, API keys, and credentials from a clean, uncompromised computer
  • Assume full system compromise and conduct forensic analysis
  • Review system logs and network traffic for signs of unauthorized access or data exfiltration
  • Consider rebuilding affected systems from clean media if possible
  • Audit all systems that may have been affected by this package for additional malware

Sources

  1. GitHub Advisory GHSA-4jfq-h5q8-g7hm · GitHub Advisory Database

Cite this entry

"Malware in node-fetch-utils." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 23, 2026; last updated June 23, 2026. https://supplychainattack.org/incident/malware-in-node-fetch-utils-wwuwix

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malicious code in testingsmthb1g (npm)

    The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.

    npmCompromised package
  2. resolvedcritical

    Malicious code in mutex-core (npm)

    The npm package mutex-core, published under a name resembling the popular async-mutex library, contained malicious code including a staged loader that decrypts and executes hidden payloads. The package included obfuscated code that conditionally triggers AES-256-GCM decryption and execution of encrypted binary content when specific conditions are met.

    npmCompromised package
  3. containedcritical

    Malicious code in tyepescript-cli (npm)

    tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.

    npmTyposquattingCompromised package
  4. containedcritical

    Malicious code in commandor-cli (npm)

    commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.

    npmCompromised packageMalicious commit