Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →To remove a suspected malicious npm package, first confirm the exact affected package versions, then remove the dependency from your manifests and lockfile, rebuild with npm ci, and investigate whether its code could have run. If a token or secret was accessible during suspicious execution, revoke or rotate it and check for activity performed with that credential. Deleting a folder from node_modules alone does not remove the dependency or establish that your project is clean.
1. Confirm the package name and affected versions
Start with the security alert or advisory that prompted the investigation. Record the exact npm package name, the versions identified as affected, when the dependency entered the project, and whether it is a direct dependency or arrives through another package. Do not assume every release is malicious: use the advisory’s affected-version range to determine whether your project is implicated.
For a suspected malware report, npm asks reporters to provide the package name and all affected versions they know about. See npm’s malware reporting guidance.
2. Find every reference to the package
Check the project files and dependency tree, not just the installed directory. Look for the package in:
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
package.jsonand workspace package manifests.package-lock.jsonornpm-shrinkwrap.json.- The installed dependency tree and any relevant workspace installations.
- Other repositories in your organization that may use the same package or affected version.
Inspect manifest and lockfile history, recent commits, and pull requests to see how and when it was added or updated. For a transitive dependency, identify the parent package that brings it into the graph. GitHub’s supply-chain investigation guidance also recommends reviewing repositories, dependency history, and related changes.
3. Remove it from the dependency graph
If it is a direct dependency
In the project or workspace that declares it, run:
npm uninstall <package>
Replace <package> with the exact package name. Review the resulting changes to the manifest and lockfile before committing them. By default, npm uninstall updates package.json and package-lock.json or npm-shrinkwrap.json; see the npm uninstall documentation.
If it is a transitive dependency
Update or remove the parent dependency that introduces the affected package, then review the updated dependency graph and lockfile. Removing only the package directory from node_modules is not a durable fix: the next install can bring it back because the dependency records still request it.
4. Rebuild from the corrected lockfile
After reviewing and correcting the lockfile, run npm ci in the project. npm requires an existing lockfile for this command, removes the existing node_modules directory before installing, and does not rewrite the lockfile. That makes it useful for rebuilding from the recorded dependency versions; consult the npm ci documentation for command behavior.
Rank #3
A successful clean install is not a malware scan and cannot tell you whether the package executed before removal, whether credentials were accessed, or whether another part of the environment was changed. Continue the exposure review separately.
5. Check whether the package could have run
Establish when the affected version was installed and consider every place code could have executed during that period:
- Dependency installation, including any package lifecycle or post-install scripts.
- Build scripts, tests, and application runtime.
- Continuous-integration jobs and other automation with access to the repository or its secrets.
Review relevant GitHub Actions runs and logs, recent pushes and workflow changes, secret-scanning findings, and available audit logs. Expand the search to other organizational repositories where the package or version may appear. GitHub’s incident-investigation guidance describes these kinds of checks, but available features and logs depend on plan, role, permissions, configuration, and prior setup.
Supply-chain incidents can involve credential compromise, code injection, or data exfiltration. A package appearing in a lockfile shows dependency presence; it does not by itself establish that its code ran or that data was stolen. Correlate the affected-version dates with installs and job activity, and investigate any unexpected repository, account, or workflow changes.
Recommended Free Tools
Best Value
6. Revoke exposed credentials and report suspected malware
Contain credentials
If a token, key, or secret was available to suspicious execution, treat it as compromised: revoke or rotate it, replace it in the systems that need it, and investigate activity performed with the affected credential. Check for unexpected repository, account, and workflow changes rather than assuming rotation alone resolves any changes already made. GitHub’s incident guidance covers credential response and related investigation at its supply-chain security documentation.
Report the package to npm
Use the package page’s Report malware flow to report suspected malicious behavior. Include the package name, all known affected versions, and useful evidence such as relevant commits, package references, or code examples. npm says it validates reports and may remove a package and publish an advisory; the reporting guidance explains what to provide.
Reduce the chance of a repeat
Review whether CI jobs need long-lived credentials and limit access to secrets that a dependency installation or build could reach. GitHub’s Principal Product Security Engineer Greg Ose and Principal Software Engineer Zachary Steindler wrote on July 28, 2026: “The number one thing you can do to disrupt these attacks is to remove long-lived credentials from your CI/CD pipeline.” This is general supply-chain guidance, not a finding about whether a particular project was compromised. See GitHub’s supply-chain security updates.
Automated alerts can help identify known malicious versions and guide response, but they cannot alone establish whether an already-installed package executed or whether credentials were stolen. Coverage and investigation features vary with repository scope, permissions, plan, configuration, and workflow.
For context, GitHub reported that it immediately removed more than 500 compromised packages from the npm registry during its response to Shai-Hulud in September 2025. That figure describes that incident response, not the total number of malicious npm packages or the likelihood that any individual project is exposed. GitHub also reported that Dependabot version-update pull requests wait until a release has been available for at least three days by default, while security updates continue to open immediately. This cooldown is not evidence that a release is safe after three days. See GitHub’s supply-chain security updates.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
