0sec-cli (npm): malicious package compromises machines that install it — rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub published a malware advisory (GHSA-9j97-6pqr-qvrx) for the npm package 0sec-cli, flagging version 0.28.10 as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. All secrets and keys stored on affected machines should be treated as stolen. No patched version exists and no source code is known; the advisory recommends removal of the package while warning that removal may not eliminate all malicious software. The package shows ~1,068 monthly downloads and 605 GitHub stars, so some real-world exposure is plausible, though no specific victim organisations are named.
What to do
- Treat any machine with 0sec-cli installed as fully compromised; rotate all secrets and keys from a clean machine immediately
- Remove the package and rebuild/reimage affected systems rather than trusting cleanup
- Audit dependency lockfiles and CI environments for 0sec-cli and block it in registries/proxies
- Review access logs and credentials (cloud keys, tokens, SSH) for signs of exfiltration
Sources
All live incidents on Threat Watch
