Malware in nodemon-client
Malware discovered in the npm package nodemon-client. Systems with this package installed or running are considered fully compromised and require immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with nodemon-client installed or running
- Ecosystems
- Attack vectors
- Affected entities
- nodemon-clientnpm package
A malware-laden version of the npm package nodemon-client has been identified and published to the npm registry. The package is flagged as critical severity by GitHub's advisory system.\n\nAny computer with nodemon-client installed or running should be considered fully compromised. The malware grants outside entities full control of affected systems.\n\nImmediate remediation requires rotating all secrets and keys from a different, uncompromised computer. While the package should be removed, complete removal of all malicious software cannot be guaranteed due to the level of system compromise.\n\nThis incident was disclosed via GitHub Advisory GHSA-cw3m-3cvq-pwp2 on 2026-07-13.
Indicators of compromise
- Packages
- nodemon-client
Remediation
- Immediately rotate all secrets, keys, and credentials from a different, uncompromised computer
- Remove the nodemon-client package from all affected systems
- Conduct a full security audit and forensic analysis of any system that had nodemon-client installed
- Review system logs and network traffic for signs of unauthorized access or data exfiltration
- Consider the affected system(s) as potentially fully compromised and plan for complete rebuild if critical infrastructure
Sources
- GitHub Advisory GHSA-cw3m-3cvq-pwp2 · GitHub Advisory Database
Cite this entry
"Malware in nodemon-client." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 13, 2026; last updated July 13, 2026. https://supplychainattack.org/incident/malware-in-nodemon-client-149eok
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @logdna-web/styles
Malware was discovered in the npm package @logdna-web/styles. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in @flex-ng/filter-pipe
Malware discovered in the npm package @flex-ng/filter-pipe. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in @idms-corp/auth-ui
Malware discovered in the npm package @idms-corp/auth-ui. Systems with this package installed are considered fully compromised, with potential for complete system takeover.
npmCompromised package - activecritical
Malware in salesforce-vscode-slds
Malware was discovered in the npm package salesforce-vscode-slds. Any system with this package installed is considered fully compromised and poses a critical risk to stored secrets and keys.
npmCompromised package