Malware in @thymelab/logfx
Malware was discovered in the npm package @thymelab/logfx. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- @thymelab/logfx
A critical malware incident was identified in the npm package @thymelab/logfx. According to the GitHub Advisory (GHSA-j2pw-qr45-rpjm), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory indicates that the malicious package may have granted outside entities full control of affected systems. All secrets and keys stored on compromised computers should be rotated immediately from a different, unaffected system.\n\nWhile removal of the package is recommended, there is no guarantee that uninstalling it will remove all malicious software that may have been installed as a result of the initial compromise. A full security audit and potential system rebuild may be necessary for affected systems.
Indicators of compromise
- Packages
- @thymelab/logfx
Remediation
- Immediately remove @thymelab/logfx from all systems
- Rotate all secrets, API keys, and credentials from a clean, unaffected computer
- Conduct a full security audit of any system that had this package installed
- Consider rebuilding affected systems from clean media if full compromise is suspected
- Review system logs and network traffic for signs of unauthorized access or data exfiltration
- Monitor for any unauthorized access attempts using rotated credentials
Sources
- GitHub Advisory GHSA-j2pw-qr45-rpjm · GitHub Advisory Database
Cite this entry
"Malware in @thymelab/logfx." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malware-in-thymelab-logfx-4h9p05
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in alphazone
The npm package alphazone contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package