@blueskydataplatform/shared-ui: npm package is malware, full compromise of any machine where installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-23
GitHub published advisory GHSA-6x9m-j5h8-w3vg on 2026-10-23 flagging the npm package @blueskydataplatform/shared-ui as malware (CWE-506, embedded malicious code). Every published version (= 0) is affected and no patched version exists; the package has no known source code repository. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, meaning an attacker may have obtained full control, including access to secrets, keys and credentials stored on the machine. Removal of the package alone cannot be assumed to remove all malicious software. Any developer, CI system or host that installed this package is affected.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where the package was installed, using a clean machine
- Rebuild affected machines/CI runners from trusted images rather than just uninstalling the package
- Audit dependency lockfiles and remove @blueskydataplatform/shared-ui from all projects and caches
- Review logs and systems for signs of attacker activity following installation
- Block the package in internal registries/proxies to prevent reinstallation
Sources
All live incidents on Threat Watch
