Malware in uipath-sugar-sell
Malware discovered in the npm package uipath-sugar-sell. Systems with this package installed are considered fully compromised and may have given outside entities full control.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- uipath-sugar-sell
A malicious npm package named uipath-sugar-sell has been identified and published to the npm registry. The package contains malware that compromises any system on which it is installed or executed.\n\nAccording to the GitHub Advisory (GHSA-xc4q-c25v-qv6v), any computer running this package should be considered fully compromised. The advisory recommends immediate rotation of all secrets and keys from a different, uncompromised computer.\n\nWhile removal of the package is advised, there is no guarantee that uninstalling it will remove all malicious artifacts, as the attacker may have gained full control of the affected system during execution.\n\nUsers should treat any system that installed or ran this package as potentially fully compromised and take appropriate incident response measures.
Indicators of compromise
- Packages
- uipath-sugar-sell
Remediation
- Immediately isolate any system that installed or ran uipath-sugar-sell from the network
- Rotate all secrets, API keys, credentials, and tokens from a clean, uncompromised computer
- Remove the uipath-sugar-sell package from all systems
- Conduct a full forensic investigation of affected systems to identify any additional malicious artifacts or persistence mechanisms
- Review system logs and network traffic for indicators of compromise or data exfiltration
- Consider full system reimaging if the package was installed on production or sensitive systems
- Audit npm dependencies across your organization to identify any other installations of this package
Sources
- GitHub Advisory GHSA-xc4q-c25v-qv6v · GitHub Advisory Database
Cite this entry
"Malware in uipath-sugar-sell." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 29, 2026; last updated June 29, 2026. https://supplychainattack.org/incident/malware-in-uipath-sugar-sell-nweaec
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in testingsmthb1g (npm)
The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.
npmCompromised package - resolvedcritical
Malicious code in mutex-core (npm)
The npm package mutex-core, published under a name resembling the popular async-mutex library, contained malicious code including a staged loader that decrypts and executes hidden payloads. The package included obfuscated code that conditionally triggers AES-256-GCM decryption and execution of encrypted binary content when specific conditions are met.
npmCompromised package - containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit