Embedded Malicious Package Affecting @toptal/picasso-charts package, versions =59.1.4
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-TOPTALPICASSOCHARTS-11023365
- published29 Jul 2025
- disclosed20 Jul 2025
- creditUnknown
Introduced: 20 Jul 2025
Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the @toptal/picasso-charts package.
Overview
@toptal/picasso-charts is a malicious package.
through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private repositories, delete code, and publish tampered versions of the package to npm.
Script Behavior
This malicious code performs a two-stage attack: first, it exfiltrates the victim's GitHub authentication token to an attacker-controlled endpoint for persistent access. Second, it attempts to destroy the victim's filesystem using sudo rm -rf --no-preserve-root / on Unix-based systems or rm /s /q on Windows.