We received a security alert from our admin team regarding a recent npm supply chain attack that affected 187 packages. The attack involved self-propagating malware, which could potentially impact environments using npm-based components.

​

We understand that Sitefinity, particularly the AdminApp and some frontend features, may utilize npm packages. Since we’re currently using Sitefinity version 14.4 as our website content management system, we’d like to confirm whether this version is affected by any of the compromised packages.

​

Below are some articles detailing the impacted npm packages for your reference:

Self-propagating supply chain attack hits 187 npm packages 

Self-Replicating Worm Hits 180+ npm Packages to Steal Credentials in Latest Supply Chain Attack

​

Please let us know if Sitefinity is impacted or if any action is recommended.

Thanks

Regards,​

​