Malware in notifications-broadcast
The npm package notifications-broadcast contained malware that provided full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- notifications-broadcast
The npm package notifications-broadcast was found to contain malware. According to the GitHub advisory, any computer that has this package installed or running should be considered fully compromised, with all secrets and keys stored on that computer at risk.\n\nThe malware granted outside entities full control of affected systems. While the package should be removed, there is no guarantee that removing it will eliminate all malicious software that may have been installed as a result of the compromise.\n\nImmediate remediation requires rotating all secrets and keys from a different, uncompromised computer, and removing the package from all affected systems.
Indicators of compromise
- Packages
- notifications-broadcast
Remediation
- Immediately rotate all secrets and keys from a different, uncompromised computer
- Remove the notifications-broadcast package from all affected systems
- Audit all systems that had this package installed for signs of additional malware or unauthorized access
- Review logs for any suspicious activity during the period the package was installed
- Consider full system reimaging for critical systems if compromise is suspected
Sources
- GitHub Advisory GHSA-hh3x-6gh6-rhxf · GitHub Advisory Database
Cite this entry
"Malware in notifications-broadcast." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 31, 2026; last updated August 1, 2026. https://supplychainattack.org/incident/malware-in-notifications-broadcast-xr0jgx
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in test-dev-exec
The npm package test-dev-exec contained malware that provided full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - resolvedcritical
Malware in test-dev-link
Malware was discovered in the npm package test-dev-link. The package grants full system compromise to attackers, requiring immediate removal and credential rotation from a clean system.
npmCompromised package - resolvedcritical
Malware in @moxfive-llc/common
Malware was discovered in the npm package @moxfive-llc/common. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malware in test-dev-dispatch
Malware was discovered in the npm package test-dev-dispatch. The package grants full system compromise to attackers, requiring immediate removal and credential rotation from a clean system.
npmCompromised package