Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malware in test-dev-boot

Malware was discovered in the npm package test-dev-boot. The package grants full system compromise to attackers and should be considered a critical threat to any system where it is installed or running.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system with the package installed or running
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • test-dev-boot

A malicious npm package named test-dev-boot was identified and published to the npm registry. The package contains malware that provides attackers with full control of any system on which it is installed or executed.\n\nAccording to the GitHub Advisory (GHSA-fxj3-2jph-p7mg), any computer with this package installed or running should be considered fully compromised. The advisory recommends immediate rotation of all secrets and keys from a different, uncompromised computer.\n\nWhile removal of the package is advised, the advisory notes that full system compromise may have occurred, meaning removal of the package alone may not eliminate all malicious software that was installed as a result.\n\nUsers should treat any system that has had this package installed as potentially fully compromised and take appropriate incident response measures.

Indicators of compromise

Packages
  • test-dev-boot

Remediation

  • Immediately remove the test-dev-boot package from all systems
  • Rotate all secrets, API keys, credentials, and authentication tokens from a clean, uncompromised computer
  • Assume full system compromise and conduct forensic analysis on affected systems
  • Review system logs and network traffic for signs of unauthorized access or data exfiltration
  • Consider rebuilding affected systems from clean media if full compromise is suspected
  • Audit all systems that may have been accessed using credentials stored on compromised machines

Sources

  1. GitHub Advisory GHSA-fxj3-2jph-p7mg · GitHub Advisory Database

Cite this entry

"Malware in test-dev-boot." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 1, 2026; last updated August 1, 2026. https://supplychainattack.org/incident/malware-in-test-dev-boot-1ux08j

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malware in test-dev-exec

    The npm package test-dev-exec contained malware that provided full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.

    npmCompromised package
  2. resolvedcritical

    Malware in test-dev-link

    Malware was discovered in the npm package test-dev-link. The package grants full system compromise to attackers, requiring immediate removal and credential rotation from a clean system.

    npmCompromised package
  3. resolvedcritical

    Malware in @moxfive-llc/common

    Malware was discovered in the npm package @moxfive-llc/common. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.

    npmCompromised package
  4. resolvedcritical

    Malware in test-dev-dispatch

    Malware was discovered in the npm package test-dev-dispatch. The package grants full system compromise to attackers, requiring immediate removal and credential rotation from a clean system.

    npmCompromised package