adyen-web-v6 (npm): lookalike of Adyen's checkout SDK ships malware; full machine compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-10-27
adyen-web-v6 is an unscoped name lookalike of Adyen's real SDK, which is published on npm as @adyen/adyen-web and maintained by Adyen (registry maintainers include adyencom; latest 6.47.0, modified 2026-10-15). It is not a hijack of Adyen's package. The registry now holds only npm's security placeholder (0.0.1-security, 2026-10-27), and its history lists one earlier version, 99.1.0, dated 2026-04-27. No source we could read confirms that 99.1.0 was the malicious release. GitHub's malware advisory GHSA-r77r-rw3m-rjh5 classifies the package as embedded malicious code (CWE-506). It says any host where the package was installed or run should be considered fully compromised, with secrets rotated from a different machine. OSV's MAL-2026-18344 does not list specific versions, so the all-versions range is the only scope source. No patched version exists, and the fix is removal, host rebuild and credential rotation. Last-month downloads to 2026-10-26 were 34.
What to do
- Search lockfiles, CI logs and node_modules for adyen-web-v6; remove it from every project
- Treat any host or CI runner that installed adyen-web-v6 as fully compromised: rotate every secret it could read from a clean machine, then rebuild or reimage rather than trusting uninstall
- Confirm your checkout code imports @adyen/adyen-web (the real package), not adyen-web-v6, and pin it to a version you have verified
- Block adyen-web-v6 in registry proxies and dependency firewalls
- Review logs for outbound traffic from build and developer hosts that had the package installed
Sources
All live incidents on Threat Watch
