Embedded Malicious Code Affecting is package, versions >3.3.0 <3.3.2
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-IS-10882268
- published24 Jul 2025
- disclosed19 Jul 2025
- creditUnknown
Introduced: 19 Jul 2025
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the is package.
Overview
is is a malicious package. through obfuscated JS code in 'index.js'. A malicious actor compromised the credentials of one of the maintainers via a phishing attack; This allowed the attacker to publish tampered versions of the package to npm.
Script Behavior
The malicious loader included in the package reconstructs a hidden script in memory, executes it, and then collects system information and environment variables. It establishes a WebSocket connection to a threat actor, sending collected data and executing arbitrary JavaScript received, effectively creating a remote shell and potentially persisting on the system if the process was created with write permissions.
Note:
The malware uses a persistence mechanism by overwriting index.js. To effectively remove it, users are recommended to both reset the lockfiles, and delete node_modules to fully eliminate the infection.