npm package report

Is xz-utils safe?

Version 5.6.1 of xz-utils was compromised (remote access trojan dropper). Other versions are not flagged as malicious.

Do not install xz-utils 5.6.1

CRITICALanalyst verified

Remote access trojan dropper, part of the shai-hulud-2025 campaign, verified by a CyberXYZ analyst.

// what we observed

Part of the Sep 2025 Shai-Hulud npm supply chain campaign. Phishing-led maintainer compromise, malicious package updates, credential/token theft, CI/CD persistence.

year: 2025
mitre ttp: T1195.001

// versions and what to do

Malicious: 5.6.1
Move to: 1.0.2 current release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install xz-utils@1.0.2

// reach

0 direct dependencies

none carry a known advisory

0 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-31 at 00:00 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.