berg-fonbock (npm): malicious package compromises any machine where it is installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's malware advisory database flagged the npm package berg-fonbock as embedded malicious code (CWE-506), published 2026-11-13. All versions (= 0) are affected and no patched version exists; the package has no known source code repository. Any computer with the package installed or running must be considered fully compromised, with control potentially handed to an outside entity. Secrets and keys stored on affected machines are at risk and removal of the package does not guarantee removal of all malicious software. No CVE is assigned; remediation is removal plus credential rotation from a clean machine.
What to do
- Remove berg-fonbock from all projects and dependency trees (check lockfiles and transitive dependencies)
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild or wipe compromised machines; do not assume package removal fully cleans the host
- Audit npm install and CI logs for berg-fonbock installs and review for signs of compromise
- Block the package in internal registries and dependency scanning policies
Sources
All live incidents on Threat Watch
