Malicious Package Affecting github.com/ordinarymea/tnsr_ids package, versions *
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMORDINARYMEATNSRIDS-11951444
- published17 Aug 2025
- disclosed14 Aug 2025
- creditOlivia Brown
Introduced: 14 Aug 2025
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the github.com/ordinarymea/tnsr_ids package.
Overview
github.com/ordinarymea/tnsr_ids is a malicious package. This package contains malicious code designed to provide attackers with on-demand remote access to a developer's system or CI/CD environment. The package and some other variants use typosquatting to imitate legitimate packages. Upon installation, the code silently executes a shell command to download a second-stage payload from a remote command-and-control (C2) server. This payload is then executed in memory, giving the attacker control over the compromised system.