agentenact (npm): malicious package 0.2.0 fully compromises machines that install it (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-27
GitHub published a malware advisory (GHSA-7p7m-8jmq-qp93) for the npm package agentenact, version 0.2.0, on 2026-10-27. The package contains embedded malicious code (CWE-506) and any computer where it is installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists; the advisory recommends removal but warns removal may not eliminate all malicious software. All secrets and keys stored on affected machines should be rotated immediately from a different, uncompromised computer. No source code repository is known for the package.
What to do
- Treat any machine with agentenact 0.2.0 installed as fully compromised
- Rotate all secrets and keys stored on affected machines immediately, from a different computer
- Remove the package and rebuild/reimage affected systems, as removal may not eliminate all malicious software
- Audit dependency trees and CI environments for the package
Sources
All live incidents on Threat Watch
