Malware in puppetewebr
Malware was discovered in the npm package puppetewebr, resulting in full system compromise for any computer with the package installed or running. The advisory recommends immediate removal and rotation of all secrets and keys from a different computer.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- puppetewebr
A critical malware incident was identified in the npm package puppetewebr. According to the GitHub Security Advisory (GHSA-8hpf-vg2v-v9wc), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory indicates that the malware grants outside entities full control of affected systems. All secrets, keys, and credentials stored on compromised computers should be rotated immediately from a different, unaffected computer.\n\nWhile removal of the package is recommended, the advisory notes that full system compromise may have occurred, meaning removing the package alone may not eliminate all malicious software that was installed as a result of the initial compromise.\n\nUsers should treat any system that has run this package as potentially fully compromised and take appropriate incident response measures.
Indicators of compromise
- Packages
- puppetewebr
Remediation
- Immediately remove the puppetewebr package from all systems
- Rotate all secrets, keys, and credentials from a different, unaffected computer
- Assume full system compromise and conduct thorough forensic analysis
- Monitor affected systems for signs of persistent malware or backdoors
- Review system logs and network traffic for indicators of compromise
- Consider rebuilding affected systems from clean media if full compromise is suspected
Sources
- GitHub Advisory GHSA-8hpf-vg2v-v9wc · GitHub Advisory Database
Cite this entry
"Malware in puppetewebr." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 30, 2026; last updated July 30, 2026. https://supplychainattack.org/incident/malware-in-puppetewebr-1mk8wl
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in spectral-wraith
Malware was discovered in the npm package spectral-wraith. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package - activecritical
Malware in @spectraltest/loglevel
Malware discovered in the npm package @spectraltest/loglevel. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in wastu
The npm package wastu was found to contain malware that grants full system compromise to attackers. Any system with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malware in ag-grid-boost
Malware was discovered in the npm package ag-grid-boost. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package