blitzstrike npm package malware — full compromise of installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published a malware advisory (GHSA-g8hc-9fqj-qjj6) on 2026-11-03 for the npm package blitzstrike, version 2.4.180, classifying it as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. The package has roughly 10K monthly downloads and 515 GitHub stars, so exposure is non-trivial. There are no patched versions and no known source code; the advisory states removal of the package cannot guarantee removal of all malicious software it may have installed. Organisations running it must treat secrets and keys on affected machines as stolen and rotate them from a clean computer.
What to do
- Remove blitzstrike 2.4.180 from all systems and rebuild affected machines from trusted images
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer
- Audit affected systems for persistence mechanisms and additional malicious software
- Check dependency locks and CI caches for the package and block reinstallation
Sources
All live incidents on Threat Watch
