Skip to content
supplychainattack.orgSupply chain attack incident catalog
activecritical

Malware in uipath-sugar-sell

Malware discovered in the npm package uipath-sugar-sell. Systems with this package installed are considered fully compromised and may have given outside entities full control.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system with the package installed or running
Ecosystems
Attack vectors
Affected entities
  • uipath-sugar-sell

A malicious npm package named uipath-sugar-sell has been identified and published to the npm registry. The package contains malware that compromises any system on which it is installed or executed.\n\nAccording to the GitHub Advisory (GHSA-xc4q-c25v-qv6v), any computer running this package should be considered fully compromised. The advisory recommends immediate rotation of all secrets and keys from a different, uncompromised computer.\n\nWhile removal of the package is advised, there is no guarantee that uninstalling it will remove all malicious artifacts, as the attacker may have gained full control of the affected system during execution.\n\nUsers should treat any system that installed or ran this package as potentially fully compromised and take appropriate incident response measures.

Indicators of compromise

Packages
  • uipath-sugar-sell

Remediation

  • Immediately isolate any system that installed or ran uipath-sugar-sell from the network
  • Rotate all secrets, API keys, credentials, and tokens from a clean, uncompromised computer
  • Remove the uipath-sugar-sell package from all systems
  • Conduct a full forensic investigation of affected systems to identify any additional malicious artifacts or persistence mechanisms
  • Review system logs and network traffic for indicators of compromise or data exfiltration
  • Consider full system reimaging if the package was installed on production or sensitive systems
  • Audit npm dependencies across your organization to identify any other installations of this package

Sources

  1. GitHub Advisory GHSA-xc4q-c25v-qv6v · GitHub Advisory Database

Cite this entry

"Malware in uipath-sugar-sell." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 29, 2026; last updated June 29, 2026. https://supplychainattack.org/incident/malware-in-uipath-sugar-sell-nweaec

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malicious code in testingsmthb1g (npm)

    The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.

    npmCompromised package
  2. resolvedcritical

    Malicious code in mutex-core (npm)

    The npm package mutex-core, published under a name resembling the popular async-mutex library, contained malicious code including a staged loader that decrypts and executes hidden payloads. The package included obfuscated code that conditionally triggers AES-256-GCM decryption and execution of encrypted binary content when specific conditions are met.

    npmCompromised package
  3. containedcritical

    Malicious code in tyepescript-cli (npm)

    tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.

    npmTyposquattingCompromised package
  4. containedcritical

    Malicious code in commandor-cli (npm)

    commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.

    npmCompromised packageMalicious commit