babyyodaa (npm): malicious package runs reverse-shell script on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
The npm package babyyodaa version 1.1.0 was identified as malicious and published to the GitHub Advisory Database (GHSA-x23x-7rrv-ffw6) on 2026-11-04, credited to OpenSSF's malicious-packages database. The package's preinstall script marks a bundled shell script as executable and runs it during installation; the script contains a reverse-shell pattern that gives a remote attacker a shell on the installing machine. Any developer or CI system that installed babyyodaa 1.1.0 is potentially compromised. There are no patched versions — the package is malware and should not be used. Reach appears limited (~3 downloads/month, 3 GitHub stars), but any installation constitutes full machine compromise. Removal of the package does not undo the compromise; incident response is required for anyone who installed it.
What to do
- Check whether babyyodaa 1.1.0 (tarball SHA-256 8321ef8b36b40d9a5b5ba649e9ad4ec3bcbe18a9a484075c5e8e5e872ec0db0b) was installed in any developer machine or CI environment and treat those hosts as compromised
- If installed, isolate and rebuild affected machines and rotate all credentials, tokens, and SSH keys accessible from them
- Audit install logs and lockfiles for the package and block it in registry allowlists/proxies
- Review CI pipelines for use of the package and rotate CI secrets
- Monitor for reverse-shell/network beacon indicators on potentially affected hosts
Sources
All live incidents on Threat Watch
