npm malware: @tableau__catalog-messages/database_lower contacts a malicious domain (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-04-09
The npm package @tableaucatalog-messages/databaselower carried malicious code in version 99.9.9, published on 2026-04-09. The name had no earlier history in the registry, and its name imitates Tableau's catalog messaging, so this is a squatted name rather than a takeover of a legitimate package. OpenSSF Package Analysis classified 99.9.9 as malicious because it communicates with a domain tied to malicious activity; the domain is not named in the sources read. OSV recorded the finding on 2026-04-09. GitHub published its advisory on 2026-10-27, and npm replaced the name with a security placeholder the same day. No safe version exists. Any machine that installed it should be treated as fully compromised: rebuild it and rotate every secret it could reach, from a clean machine.
What to do
- Treat every machine that installed 99.9.9 (or any version) of @tableau__catalog-messages/database_lower as fully compromised; rebuild and rotate secrets from a clean machine
- Remove the package from projects and lockfiles; search lockfiles for the scoped name, including the double-underscore form
- Review DNS and egress logs from 2026-04-09 onward for the domain OpenSSF flagged (see the OSV MAL-2026-2866 record)
- Block the name in the internal registry and dependency scanning
Sources
All live incidents on Threat Watch
