b20miner npm package: malicious cryptominer backdoor fully compromises installed hosts (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
GitHub's malware advisory database published GHSA-fw7x-6chc-4244 on 2026-10-28 flagging npm package b20miner version 0.3.1 as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected hosts are at risk and must be rotated from a clean machine. No patched version exists; the package has no known source code repository. Removal of the package alone cannot be guaranteed to remove all malicious software it deployed. Affected users are any developers or CI systems that installed b20miner 0.3.1.
What to do
- Treat any host with b20miner 0.3.1 installed as fully compromised; isolate it
- Rotate all secrets, keys, and credentials stored on or accessible from affected hosts, from a clean machine
- Remove the package and rebuild/reimage affected systems; do not assume removal is sufficient
- Audit install logs, CI caches, and lockfiles for b20miner and block the package in registries/proxies
- Review for persistence mechanisms and unauthorized access following compromise
Sources
All live incidents on Threat Watch
