Embedded Malicious Code Affecting intercom-client package, versions =7.0.4
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-INTERCOMCLIENT-16323330
- published30 Apr 2026
- disclosed29 Apr 2026
- creditPeter van der Zee
Introduced: 29 Apr 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the intercom-client package.
Overview
Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload. A malicious actor compromised the package, enabling the attacker to publish tampered versions of the deep learning framework.
Malicious Behavior
The execution chain runs automatically on module import through a daemon thread with suppressed output. A preinstall script is added that downloads the Bun JavaScript runtime from GitHub to execute an 11 MB obfuscated JavaScript payload (router_runtime.js). The malware actively steals and exfiltrates developer tokens, environment variables, and cloud-related secrets.