bandkit (npm) — malicious package compromises any machine where it is installed; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's malware advisory database published GHSA-v69f-q3vh-9qcf on 2026-11-03 flagging the npm package 'bandkit' as embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists, meaning the package itself is malware rather than a compromised legitimate library. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially given to an outside entity, and that removal of the package does not guarantee removal of all malicious software. All developers and CI systems that installed bandkit are affected; secrets and keys on those machines must be treated as stolen and rotated from a clean computer.
What to do
- Immediately stop using and remove the bandkit package from all projects, lockfiles and CI pipelines
- Treat every machine that installed or ran bandkit as fully compromised; rotate all secrets, keys, tokens and credentials stored there from a clean computer
- Rebuild affected machines/environments from trusted images rather than trusting post-removal cleanup
- Audit npm dependency trees and CI logs for bandkit installs and any resulting suspicious activity
- Block the package name in internal registries and dependency firewall/proxy policies
Sources
All live incidents on Threat Watch
