Zero-Day Vulnerability Alert

This page summarizes the Node-gyp Supply Chain Compromise affecting multiple npm packages in the npm ecosystem.

The incident involved compromised npm packages published with malicious install-time behavior using binding.gyp / node-gyp. Unlike more common npm supply chain attacks that rely on preinstall or postinstall scripts, this activity uses binding.gyp to trigger code execution during npm install.

The compromised packages reportedly included mechanisms for credential harvesting, GitHub Actions workflow injection, credential exfiltration, and further supply chain propagation through malicious package publishing activity.

You can use this page to identify affected package versions and review recommended remediation actions.

For additional background and technical details, please refer to the Snyk Blog post

Packages affected by zero-day vulnerabilities

Showing 30 of 57 • Page 1 of 2

- C
Embedded Malicious Code in ai-sdk-ollama (npm)
Versions: 0.13.1, 1.1.1, 2.2.1, 3.8.5
- C
Embedded Malicious Code in @evolvconsulting/evolv-coder-lite (npm)
Versions: 1.2.0
- C
Embedded Malicious Code in autotel-audit (npm)
Versions: 0.1.15
- C
Embedded Malicious Code in autotel-backends (npm)
Versions: 2.12.26
- C
Embedded Malicious Code in autotel-drizzle (npm)
Versions: 0.0.27
- C
Embedded Malicious Code in eslint-plugin-executable-stories-jest (npm)
Versions: 1.2.1, 2.1.8
- C
Embedded Malicious Code in @jagreehal/workflow (npm)
Versions: 1.16.1
- C
Embedded Malicious Code in @vapi-ai/server-sdk (npm)
Versions: 0.11.1, 0.11.2, 1.2.1, 1.2.2
- C
Embedded Malicious Code in autotel (npm)
Versions: 2.26.4, 3.4.3
- C
Embedded Malicious Code in autotel-adapters (npm)
Versions: 0.3.5
- C
Embedded Malicious Code in autotel-aws (npm)
Versions: 0.13.10
- C
Embedded Malicious Code in autotel-cli (npm)
Versions: 0.8.14
- C
Embedded Malicious Code in autotel-cloudflare (npm)
Versions: 2.18.16
- C
Embedded Malicious Code in autotel-devtools (npm)
Versions: 0.1.1, 1.0.4, 2.1.1, 3.0.2, 4.0.1, 5.1.1, 6.1.2
- C
Embedded Malicious Code in autotel-edge (npm)
Versions: 3.16.13
- C
Embedded Malicious Code in autotel-eventcatalog (npm)
Versions: 1.0.1, 2.0.1, 3.0.1, 4.0.2, 5.0.1
- C
Embedded Malicious Code in autotel-hono (npm)
Versions: 0.4.26
- C
Embedded Malicious Code in autotel-mcp (npm)
Versions: 0.1.14, 2.0.1, 3.0.1, 4.0.1, 5.0.1, 6.0.1, 7.0.1, 8.0.1, 9.0.1, 10.0.1, 11.0.1, 13.0.1, 14.0.1, 15.0.2, 16.0.1, 17.0.2, 18.0.1, 19.0.1, 20.0.1, 21.1.1, 22.0.1, 23.0.1, 24.0.1, 25.0.1, 26.0.2, 27.0.1, 28.0.3, 29.0.1
- C
Embedded Malicious Code in autotel-mcp-instrumentation (npm)
Versions: 29.0.2, 30.0.5, 31.0.1, 32.0.1, 33.0.2, 34.0.1
- C
Embedded Malicious Code in autotel-mongoose (npm)
Versions: 0.0.3, 1.0.2, 2.0.5, 3.0.1, 4.0.1, 5.0.2, 6.0.1
- C
Embedded Malicious Code in autotel-pact (npm)
Versions: 0.2.2, 1.0.3
- C
Embedded Malicious Code in autotel-playwright (npm)
Versions: 0.4.32
- C
Embedded Malicious Code in autotel-plugins (npm)
Versions: 0.19.26
- C
Embedded Malicious Code in autotel-sentry (npm)
Versions: 0.5.13
- C
Embedded Malicious Code in autotel-subscribers (npm)
Versions: 4.1.1, 5.0.1, 6.0.1, 7.0.1, 8.0.1, 9.0.1, 10.0.1, 11.0.1, 12.0.1, 13.0.1, 14.1.1, 15.0.1, 16.0.2, 17.0.1, 18.0.3, 19.0.1, 20.0.1, 21.0.1, 22.0.2, 23.0.2, 24.0.1, 25.0.1, 26.0.1, 27.0.2, 28.0.2, 29.0.6
- C
Embedded Malicious Code in autotel-tanstack (npm)
Versions: 1.13.27
- C
Embedded Malicious Code in autotel-terminal (npm)
Versions: 2.1.1, 3.0.1, 4.0.2, 5.0.1, 6.0.3, 7.0.1, 8.0.1, 9.0.1, 10.0.2, 11.0.1, 12.0.1, 13.0.1, 14.0.1, 15.0.2, 16.0.2, 17.0.10, 18.0.4, 19.0.8, 20.0.2, 21.0.1, 22.0.2, 23.0.3
- C
Embedded Malicious Code in autotel-vitest (npm)
Versions: 0.4.26
- C
Embedded Malicious Code in autotel-web (npm)
Versions: 1.12.2
- C
Embedded Malicious Code in awaitly (npm)
Versions: 1.33.3

Page 1 of 2