Which versions of native-component-list are malicious?

The following npm versions of native-component-list are flagged malicious: 99.1.0. Treat any of these as compromised.

How do I remediate native-component-list if I installed it?

Remove native-component-list from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed native-component-list — how do I know if it already compromised me?

If native-component-list was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is native-component-list part of a known attack campaign?

Yes — native-component-list is associated with the GHSA-857j-xfpm-cxrp campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find native-component-list across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for native-component-list (version 99.1.0).

Malicious package

native-component-listnpm

Advisory published Dec 5, 2025Updated Dec 10, 2025

native-component-list is a confirmed malicious npm package (MAL-2025-192345) that executes malicious code on install (malicious version 99.1.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in native-component-list (npm)

MAL-2025-192345

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall native-component-list

What this malware does

The package native-component-list was found to contain malicious code.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The OpenSSF Package Analysis project identified 'native-component-list' @ 99.1.0 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

1 flagged

99.1.0

Indicators of compromise (SHA-256)

8a5b5fc0df7145b301573dc029802ddf1c8f351945d0877d43e499a34192673f

3315604aae3323533ca6bccf8397f319b41b2f6ddade8dc2699c41175171bbb8

294637f99850b075c31b8b872ebf58d4030f3c8ec0836078264a60abc4ae4f0f

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for native-component-list (version 99.1.0).
If you installed it — respond
Remove native-component-list from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If native-component-list was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. native-component-list on npm has been identified as a malicious package (version 99.1.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-857j-xfpm-cxrp

References

github.com

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks native-component-list-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database