cal-time-stamper npm package is malware — full machine compromise for any installer
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub published advisory GHSA-5xh5-qp4j-xjfx on 2026-11-11 flagging the npm package cal-time-stamper as malware (CWE-506, embedded malicious code). All versions (= 0) are affected and there are no patched versions; the package has no known source code and gets roughly 10 downloads per month. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the code hands control to an outside entity, enabling secret and key theft. Removal of the package alone is not guaranteed to remove all malicious software it installed. Any developer or CI environment that installed it is affected; remediation requires machine-level cleanup and credential rotation, not just uninstalling the package.
What to do
- Treat any machine where cal-time-stamper was installed or run as fully compromised; rebuild from clean images where possible
- Rotate all secrets, keys, tokens and credentials stored on affected machines immediately, from a different, clean computer
- Remove the package from all projects, lockfiles and CI pipelines and block/audit for it in dependency checks
- Hunt for persistence and follow-on malicious software on affected hosts; review access and network logs for exfiltration
Sources
All live incidents on Threat Watch
