apex-fetch (npm): malicious package fully compromises machines that install it; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
GitHub's advisory database published GHSA-gm35-cprq-hwp5 on 2026-10-30 flagging the npm package apex-fetch as malware (CWE-506, embedded malicious code). All versions (= 0) are affected and there are no patched versions; the package has no known source code and remains installable. GitHub states any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and exposure of all secrets and keys stored on it. Reach appears limited (~33 downloads/month), but any installation is assumed exploited. Removal of the package does not guarantee removal of malicious software, so affected hosts require full incident response including credential rotation from a clean machine and rebuild.
What to do
- Treat any machine with apex-fetch installed as fully compromised; rotate all secrets and keys from a separate, clean computer
- Remove the package and rebuild/reimage affected hosts rather than trusting cleanup
- Audit dependency lockfiles, CI caches and artifacts for apex-fetch and check for signs of compromise
- Block installs of apex-fetch and scan repositories and build pipelines for it
- Review access logs and tokens for anomalous use since installation
Sources
All live incidents on Threat Watch
