What should I do if I installed a malicious package?

Treat the machine that ran the install as exposed. Isolate it, rotate every secret it could read, find every other project and pipeline that pulled the same package, remove it, rebuild from clean state, and report the package. Move fast on secrets first, because they are what attackers usually want.

Step 1: stop and preserve

Disconnect the affected laptop or stop the CI runner. Do not delete the package yet. Note the package name, version and the time of the install. Copy the package's folder and your lockfile somewhere safe for analysis.

Step 2: rotate what it could reach

Assume anything readable by the installing user is compromised. In practice that means:

• Tokens and keys in environment variables, including those in CI.
• Files in the home directory such as SSH keys, cloud credentials and package registry tokens.
• Secrets in the project folder, such as env files.

Rotate the most powerful first: cloud credentials, source control tokens and registry publish tokens. A publish token matters most, since a stolen one lets an attacker poison your own packages.

Step 3: find the blast radius

You need to answer one question: where else did this package land? That needs an inventory.

1. Search lockfiles across repositories for the package name and version.
2. Check CI logs for installs in the relevant time window.
3. Check container images and build caches that may include it.

This is where an up to date dependency inventory pays off. Without one, step 3 turns into a day of guessing.

Click through it at your own pace, or open it full screen. Look at how a newly published finding is matched back to projects you already scan.

Step 4: clean and rebuild

Remove the dependency, pin a known good version or a replacement, and delete and recreate node_modules, virtual environments or build caches. Rebuild artifacts from clean state. For a machine that ran the script, reimage if you cannot rule out persistence.

Step 5: look for follow on activity

Review audit logs for the credentials you rotated: unusual logins, new tokens, pushes you do not recognize, new cloud resources. Check whether any of your own packages were published unexpectedly.

Step 6: report and learn

Report the package so the registry can remove it. npm's documentation says its security team confirms the report, removes the package, publishes a security placeholder and issues an advisory. See how to report a malicious package.

Then ask what would have limited the damage: scripts off by default, a clean build environment with fewer secrets, a freshness delay on new versions, or review of dependency changes in pull requests.

Quick check

Safeguard does SBOM and dependency scanning and compliance and evidence automation, which help with the inventory and the record. You can run a free scan.

Sources

• npm: reporting malware in an npm package

Last reviewed: 19 October 2026.