arbkit npm package malware — full compromise of installed machines; rotate all secrets and keys
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's malware advisory database published GHSA-8vwq-527w-6hcm on 2026-11-03 flagging the npm package arbkit as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists, so any installation is considered compromised. The advisory states that any computer with the package installed or running should be considered fully compromised by an outside entity, and all secrets and keys stored on such machines must be rotated immediately from a different, clean computer. The package sees roughly 2,974 downloads per month, so downstream projects and CI environments that pulled it are at risk. Removal of the package is advised but may not eliminate all malicious software planted during installation. There is no fix; the only safe action is removal plus full credential rotation and host remediation or rebuild.
What to do
- Treat every machine with arbkit installed as fully compromised; rotate all secrets, keys, and tokens from a clean computer immediately
- Remove arbkit from all projects, lockfiles, and CI pipelines and audit for persistence left behind
- Rebuild or thoroughly remediate affected hosts; do not assume removal of the package cleans the system
- Audit logs and network egress for signs of exfiltration or attacker activity since installation
- Block future installs of arbkit and review dependency trees for other compromised packages
Sources
All live incidents on Threat Watch
