Packages / synckit / Security

Malicious packageMAL-2025-6026Published 21 Jul 2025

Malicious code in synckit (npm)

Compromised versions · synckit

  • 0.11.9

Safe

Every other versionincluding the latest, 0.12.3

npm install synckit@0.12.3

  1. Not affected

    0.1.0 – 0.11.8

    50 releases

  2. Affected

    0.11.9

    1 release

  3. Safe

    0.11.10 – 0.12.3

    8 releases, latest

59 stable releases of synckit, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for synckit. It is read in your browser and sent nowhere.

What happens

If one of these versions was installed

  1. Treat the machines and CI runners that installed it as compromised.
  2. Rotate the npm, GitHub and cloud tokens they could reach.
  3. Reinstall from a lockfile that pins a version outside the list.

This package installs a windows based malware file node-gyp.dll via install.js