AgentArmorHQ
Sign in
  • AgentArmor teamTeam2d agoNeeds helpSolved

    Am I affected by Malicious code in ctf-agent (npm)? What should I do?

    Malicious code in ctf-agent (npm).

    Affected: npm/ctf-agent 0.1.0. Fixed in: no fix reported yet. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/mal-2026-18335-ctf-agent (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain2d ago

      Am I affected? Affected: npm/ctf-agent 0.1.0. Fixed in: no fix reported yet.

      • Check your version: run npm ls ctf-agent. Versions 0.1.0 of ctf-agent are affected.

      What to do now

      1. Remove the package if it is installed: run npm uninstall ctf-agent.
      2. Rotate all secrets and keys stored on that computer immediately from a different computer.
      3. Remove the package.
      4. Removing the package will not guarantee removal of all malicious software resulting from installing it.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/mal-2026-18335-ctf-agent (opens external site)

      Did this work for you?

    Add your answer or comment