Skip to content
supplychainattack.orgSupply chain attack incident catalog
activecritical

Malware in ts-build-optimize

Malware discovered in the npm package ts-build-optimize. Systems with this package installed are considered fully compromised and require immediate remediation.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system with the package installed or running
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • ts-build-optimizenpm package

The npm package ts-build-optimize has been identified as containing malware. According to the GitHub Advisory (GHSA-c22w-53x6-4jf5), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory recommends that all secrets and keys stored on affected computers be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the package installation, given the potential for full system compromise.\n\nAffected users should treat their systems as potentially fully compromised and take appropriate incident response measures."

Indicators of compromise

Packages
  • ts-build-optimize

Remediation

  • Immediately isolate affected systems from the network
  • Rotate all secrets, API keys, and credentials from a different, uncompromised computer
  • Remove the ts-build-optimize package
  • Perform a full security audit and malware scan of affected systems
  • Consider full system reimaging if compromise is confirmed
  • Review system logs and access logs for signs of unauthorized activity

Sources

  1. GitHub Advisory GHSA-c22w-53x6-4jf5 · GitHub Advisory Database

Cite this entry

"Malware in ts-build-optimize." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 6, 2026; last updated July 6, 2026. https://supplychainattack.org/incident/malware-in-ts-build-optimize-1ihc0s

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. activecritical

    Malware in vite-plugin-compress-js

    Malware discovered in the npm package vite-plugin-compress-js. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package
  2. activecritical

    Malware in webpack-cache-clean

    The npm package webpack-cache-clean contains malware that grants full system compromise to an attacker. Any computer with this package installed or running should be considered fully compromised.

    npmCompromised package
  3. containedcritical

    Malware in metrica-chain

    The npm package metrica-chain was found to contain malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.

    npmCompromised package
  4. containedcritical

    Malware in unique-id-64

    The npm package unique-id-64 was found to contain malware. Any computer with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different system.

    npmCompromised package