Malware in trapp-check-logs
The npm package trapp-check-logs was found to contain malware, potentially granting full system compromise to attackers. All systems with this package installed should be considered fully compromised and require immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- trapp-check-logs
The npm package trapp-check-logs was identified as containing malware. According to the GitHub Advisory (GHSA-4xfj-589v-h29h), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory recommends that all secrets and keys stored on affected computers be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the initial compromise, given that the attacker may have gained full control of the system.\n\nUsers should treat any system that has run this package as potentially containing persistent malware and take appropriate incident response measures.
Indicators of compromise
- Packages
- trapp-check-logs
Remediation
- Immediately remove the trapp-check-logs package from all systems
- Rotate all secrets, API keys, and credentials from a different, uncompromised computer
- Perform a full security audit and malware scan of any system that had this package installed
- Review system logs and network traffic for signs of unauthorized access or data exfiltration
- Consider the affected system(s) as potentially compromised and plan for full reimaging if critical systems are involved
- Monitor for any suspicious activity on accounts or systems that may have been accessed from the compromised machine
Sources
- GitHub Advisory GHSA-4xfj-589v-h29h · GitHub Advisory Database
Cite this entry
"Malware in trapp-check-logs." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malware-in-trapp-check-logs-1vyz79
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in streak-map-cache (npm)
The npm package streak-map-cache contained malicious code disguised as a native math accelerator. The package's main entrypoint executed a bundled Linux ELF binary (RedShell C2 implant) on every import, enabling remote command execution, reverse shell, credential harvesting, and data exfiltration.
npmCompromised package - resolvedcritical
Malicious code in wos-library-ui (npm)
wos-library-ui@99.0.0 on npm contained malicious code that executed a preinstall script to exfiltrate system information (hostname, username, working directory) via DNS and HTTP to an attacker-controlled Interactsh subdomain. The package exploited dependency confusion by using an inflated version number to target internal Inditex packages.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in zyr-agent (npm)
zyr-agent (npm) shipped with malicious code that enables remote command execution through a hardcoded preview-slug endpoint controlled by the package author. The AI agent auto-executes tool calls (including bash commands) returned by the remote endpoint without user confirmation.
npmAI agents & skillsMalicious commitCompromised package - containedcritical
Malicious code in xxdxax (npm)
The npm package xxdxax contains obfuscated malicious code designed to target users of a specific WordPress site. When loaded in a browser on noviembrenacional.com, it exfiltrates session data and performs account takeover attacks via CSRF.
npmCompromised package