budetzz npm packages: malware in budetzz and @budetzz/eslint-config compromises any machine that installs them
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub's advisory database flagged two npm packages, budetzz and @budetzz/eslint-config, as malware on 2026-11-12 (GHSA-xc73-36mq-8442 and GHSA-52pg-f6vh-x249). All published versions (= 0) are affected and no patched versions exist, so the packages cannot be safely used at any version. The advisories state that any computer with the packages installed or running should be considered fully compromised, implying attacker code execution and potential full machine control, and recommend rotating all secrets and keys from a separate, clean computer. budetzz shows roughly 376 downloads per month; the scoped eslint-config package's download count is not stated. Removal of the packages alone is not guaranteed to eliminate malicious software left behind. No CVE is assigned; the weakness is CWE-506 (embedded malicious code).
What to do
- Remove budetzz and @budetzz/eslint-config from all projects, lockfiles, and CI caches; treat affected machines as fully compromised
- Rotate all secrets, tokens, SSH keys, and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild affected machines and audit for persistence mechanisms left by the malware
- Audit dependency trees and lockfiles for these packages and block them in registries/proxies
- Review CI/CD and developer environments that may have installed the packages for signs of compromise
Sources
All live incidents on Threat Watch
