Skip to content

2026-02-06 — NPM syf-* packages flagged as malware (multiple GHSAs)

Sources: - https://github.com/advisories/GHSA-5mxw-3pj6-qg8r (syf-api) - https://github.com/advisories/GHSA-9wwg-6qj9-823h (syf-typings) - https://github.com/advisories/GHSA-qq2w-w2qw-56jm (syf-api-legacy)

Published: 2026-02-06
Type: Malware / supply-chain compromise

What happened

GitHub published malware advisories for three NPM packages:

  • syf-api (affected: = 1.0.0) — GHSA-5mxw-3pj6-qg8r
  • syf-typings (affected: = 99.0.0) — GHSA-9wwg-6qj9-823h
  • syf-api-legacy (affected: = 1.0.0, = 99.0.0) — GHSA-qq2w-w2qw-56jm

Each advisory contains the same high-severity guidance: any machine that installed or ran these packages should be treated as fully compromised.

Why this matters (durable guidance)

This is a repeat pattern in the current NPM malware waves: - The “fix” is usually not a patched version (often none). - The correct response is incident response (containment + credential rotation + rebuild), not just uninstall.

What to do now (triage)

If you suspect any of these packages were installed or executed:

  1. Isolate the host

  2. Disconnect or block outbound access (assume active exfil).

  3. Rotate secrets from a clean machine

  4. Rotate anything that was reachable from the host: cloud/API keys, CI secrets, SSH keys, browser sessions, package tokens (npm), etc.

  5. Rebuild rather than “clean”

  6. Prefer re-imaging / ephemeral rebuilds of dev machines and CI runners.

  7. Scope exposure

  8. Identify where the host authenticated (GitHub orgs, cloud accounts, registries).

  9. Review auth logs and unusual outbound connections around install/execute time.

  10. Harden your dependency intake

  11. Lockfiles, dependency review gates, allowlists/private registries, and SBOM/provenance checks where available.

References

  • GitHub Advisory (syf-api): https://github.com/advisories/GHSA-5mxw-3pj6-qg8r
  • GitHub Advisory (syf-typings): https://github.com/advisories/GHSA-9wwg-6qj9-823h
  • GitHub Advisory (syf-api-legacy): https://github.com/advisories/GHSA-qq2w-w2qw-56jm
  • Related checklist: /checklists/malicious-package-response.md
  • Related best practice: /best-practices/supply-chain-malware-triage.md