Treat a credible malicious-dependency alert as a security incident until you can rule it out. Stop affected installs and builds, identify where the package was installed or executed, contain potentially affected systems, and revoke credentials the code could access. Then investigate, restore from trusted sources, and follow the current advisory for that package and ecosystem.
1. Triage the alert and escalate
Record the alert source, package name, ecosystem, affected version range, detection time, and any indicators or recommended actions. Check the relevant registry notice and security advisory, but do not delay containment for a lengthy investigation. GitHub’s incident-response guidance recommends treating a signal as real and moving to containment if it cannot quickly be ruled out as a false positive (GitHub incident response).
- Notify your security or incident-response team and the owners of affected repositories, build pipelines, or services.
- Preserve the alert, relevant logs, lockfiles, build records, and a timeline of package resolution and execution.
- Assess whether legal, regulatory, customer, or vendor notifications may apply to your organization.
A package appearing in a manifest is not by itself proof that malicious code ran. Conversely, removing it from the current manifest does not establish that a machine or build environment that already ran it is clean.
2. Find every affected copy and execution environment
Scope the incident by tracing the package’s versions and activity across the dependency lifecycle—not just by searching the current project declaration. Compare the alert’s affected versions with manifests, lockfiles, dependency graphs, build records, and artifacts.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- Check direct and transitive dependencies, package-manager caches, artifact repositories, and built outputs.
- Review CI/CD jobs and logs, developer machines, test environments, containers, and production hosts.
- Determine when the affected release was downloaded, installed, built, or executed, and which jobs or users had access to that environment.
- List affected repositories, pipeline runs, hosts, users, and credentials; keep the timeline current as new evidence appears.
GitHub’s investigation guidance describes areas such as dependency graphs, code search, workflow logs, and audit logs; CISA and Singapore’s Cyber Security Agency also emphasize finding affected systems and activity (GitHub investigation areas; CISA alert; Singapore CSA advisory).
3. Stop further use and contain affected systems
Prevent new installs or builds from resolving to the suspect release. Pause affected pipeline jobs or block the version through your organization’s package controls while responders establish the safe path forward.
Rank #2
- Pin or downgrade to a release that the current incident advisory identifies as safe, or replace the dependency with a verified alternative.
- Remove malicious package artifacts and caches identified by the advisory.
- Isolate hosts suspected of having executed the package while they are investigated and remediated.
Do not treat any version as universally safe: the correct version and cleanup steps depend on the specific package and incident. Use the current ecosystem advisory for exact versions, files, and indicators. CISA and Singapore CSA describe containment and removal actions in their incident guidance (CISA alert; Singapore CSA advisory).
4. Revoke credentials the code could access
Assume credentials available to an affected execution environment may have been exposed, especially if the package ran. Inventory secrets present on affected developer machines and in pipeline jobs, including credentials injected only for a particular CI run.
Recommended Free Tools
Rank #3
- Revoke or rotate relevant package-registry, source-control, CI/CD, cloud, SSH, API, and environment credentials.
- Issue replacements from a clean environment, then update the systems that depend on them.
- Review audit logs and connected services for suspicious use of the old credentials.
Choose the scope based on what each affected process could access; do not limit the review to secrets explicitly named in the dependency alert. CISA, GitHub, and Singapore CSA all address credential protection in their incident guidance (CISA alert; GitHub incident response; Singapore CSA advisory).
5. Investigate, restore, and verify
After immediate exposure is controlled, investigate whether the package did more than its declared job. Use incident-specific indicators from the relevant advisory and review the affected time window for:
- Unexpected child processes, outbound network connections, or newly created files and binaries.
- Unauthorized commits, workflow edits, new runners or webhooks, unfamiliar applications, or new deploy keys.
- Changes to dependencies, build outputs, or other artifacts that could carry the compromise forward.
Rebuild or reinstall from trusted sources with verified dependency versions. Confirm that affected artifacts and caches are addressed, replacement credentials are in use, and suspicious access has stopped. Continue monitoring relevant endpoint, workflow, repository, and service logs after restoration. CISA and GitHub describe investigation and recovery areas in their guidance (CISA alert; GitHub incident response).
6. Report suspected malware through the relevant registry
For npm packages
npm’s malware-reporting process asks for the package name, all affected versions, a concise description of the behavior and impact, and supporting evidence such as references, commits, or code samples. npm says it validates reports and, for confirmed malicious packages, removes the package, publishes a placeholder and advisory, and may ban the uploading account. Follow npm’s guidance for vulnerability reports that are not malware; those should be reported privately to the package maintainers (npm malware reporting).
For other ecosystems
Use the package registry or maintainer’s current reporting route and include the affected package versions, observed behavior, impact, and reproducible evidence where safe to share. Reporting does not replace containment or credential remediation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Historical example: the March 2026 Axios npm incident
CISA’s alert dated April 20, 2026, describes an attack on March 31, 2026, involving axios@1.14.1 and axios@0.30.4. The alert says the attack injected plain-crypto-js@4.2.1 and downloaded multi-stage payloads, including a remote access trojan. For that incident, CISA recommended downgrading to axios@1.14.0 or axios@0.30.3, deleting node_modules/plain-crypto-js/, rotating potentially exposed credentials, and hunting for indicators (CISA alert).
Those version recommendations are specific to the historical incident, not a general rule or a current safe-version recommendation. Check the current advisory before changing versions in response to a different or ongoing alert.
Reduce the chance of a repeat incident
Make it easier to identify what is present, where it runs, and what access it has. Singapore CSA recommends software bill of materials (SBOM) inventory, dependency scanning, and CI/CD and endpoint monitoring; GitHub’s guidance describes using dependency and repository investigation capabilities (Singapore CSA advisory; GitHub investigation areas).
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
- Keep dependency manifests and lockfiles under review and make them available to incident responders.
- Limit the credentials and permissions available to build jobs and developer accounts to what they need.
- Monitor pipeline and endpoint activity so unexpected processes or access can be investigated.
- Use phishing-resistant multifactor authentication on developer accounts, especially accounts controlling critical platforms; CISA recommends this control in its alert (CISA alert).
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
