Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malware in @sentryx-libraries/auth-interceptor

Malware was discovered in the npm package @sentryx-libraries/auth-interceptor. Systems with this package installed are considered fully compromised and require immediate remediation.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system with the package installed or running
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • @sentryx-libraries/auth-interceptor

A malicious package, @sentryx-libraries/auth-interceptor, was published to npm and contains malware. Any computer with this package installed or running should be considered fully compromised, with potential for complete system takeover by an external entity.

The advisory warns that all secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the package installation.

This incident was disclosed via GitHub Advisory GHSA-2h8m-qr63-3f64 on 2026-06-29.

Indicators of compromise

Packages
  • @sentryx-libraries/auth-interceptor

Remediation

  • Immediately remove @sentryx-libraries/auth-interceptor from all systems
  • Rotate all secrets, keys, and credentials from a different, uncompromised computer
  • Perform a full security audit and malware scan of affected systems
  • Review system logs for unauthorized access or activity
  • Consider full system reimaging if compromise is suspected
  • Monitor for any signs of persistent malware or backdoors

Sources

  1. GitHub Advisory GHSA-2h8m-qr63-3f64 · GitHub Advisory Database

Cite this entry

"Malware in @sentryx-libraries/auth-interceptor." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 29, 2026; last updated June 29, 2026. https://supplychainattack.org/incident/malware-in-sentryx-libraries-auth-interceptor-1piyvg

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. activecritical

    Malware in sui-move-graphql

    Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.

    npmCompromised package
  2. resolvedcritical

    Malware in ulebkit

    The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.

    npmCompromised package
  3. containedcritical

    Malicious code in runtime-health (npm)

    The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.

    npmCompromised package
  4. activecritical

    Malware in gator-client

    The npm package gator-client contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.

    npmCompromised package