@capsense npm packages (@capsense/core-ui, @capsense/ccx-welcome-page) — malicious packages fully compromise installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub's advisory database published two malware advisories on 2026-10-26 for npm packages @capsense/core-ui (GHSA-c2qc-c78r-386v) and @capsense/ccx-welcome-page (GHSA-phgq-4c2g-6xpx). Both are flagged as embedded malicious code (CWE-506) with every version (= 0) affected and no patched versions available. GitHub states any computer with the packages installed or running should be considered fully compromised, implying attacker control of the machine and access to secrets and keys. There is no safe version; removal of the package does not guarantee removal of all malicious software it may have deployed. Any project depending on these packages, directly or transitively, is affected.
What to do
- Immediately rotate all secrets, keys, tokens and credentials stored on any machine where these packages were installed, using a clean, uncompromised computer
- Remove both packages from all projects and lockfiles and audit for transitive dependencies on them
- Rebuild affected systems from trusted images; do not assume uninstalling the package removed the malware
- Review CI/CD and developer machines that ran installs or builds for persistence and indicators of compromise
- Block the @capsense scope in npm installs and dependency firewall policies
Sources
All live incidents on Threat Watch
