npm 'is' published malicious versions after maintainer account takeover
The registry advisory landed on 13 September and unpinned CI jobs and fresh `npm install` runs keep resolving the package this week; a build agent that ran a poisoned version should be treated as having leaked every token in its environment.
The npm registry advisory GHSA-6f4g-3jvw-4j45 records that unauthorized versions of the widely depended-on npm package 'is' were published from a compromised maintainer account and contained obfuscated malicious code. 'is' is pulled in transitively by large numbers of JavaScript build trees, so any unpinned install or CI resolution during the publish window could have executed attacker code on build hosts with access to environment secrets.
Affected: npm package 'is' — the unauthorized versions published during the maintainer account compromise, as enumerated in GHSA-6f4g-3jvw-4j45 (all other versions unaffected)
How to Test
Grep package-lock.json / yarn.lock / pnpm-lock.yaml across all repos for a resolved 'is@' version matching the advisory list, run `npm ls is` to find transitive pulls, inspect ~/.npm/_cacache and CI runner caches and Artifactory/Verdaccio mirrors for tarballs of those versions, and review build-agent egress and npm-token usage logs for the publish window.
How to Mitigate
Pin or upgrade 'is' to a known-good version listed in the advisory, purge npm/CI caches and any internal registry mirror copies of the malicious tarballs, rebuild affected artifacts, and rotate every secret exposed to hosts that installed them (npm publish tokens, CI variables, cloud keys, SSH deploy keys).