agent-trace-kit (npm): malicious package compromises any machine where installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-p844-4jjv-h39f) for the npm package agent-trace-kit on 2026-11-10. All versions (= 0) contain embedded malicious code (CWE-506) and no patched versions exist. Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; secrets and keys on affected machines are at risk. Removal of the package does not guarantee removal of all malicious software it installed. No fixed version is available; the only remediation is removal plus full incident response.
What to do
- Rotate all secrets and keys stored on affected machines immediately, from a clean computer
- Remove agent-trace-kit from all projects and lockfiles and block it in dependency policies
- Rebuild/reimage affected machines; audit for persistence and attacker access
- Review CI/CD and developer environments for exposure and credential use during compromise window
Sources
All live incidents on Threat Watch
