@cecm-web-sdk/core: npm package is malware, full compromise of installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-23
GitHub's malware advisory database published GHSA-88qx-q5v7-q7x5 on 2026-10-23 flagging the npm package @cecm-web-sdk/core as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists; the package has no known source code repository. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, meaning an attacker may have full control and access to secrets, keys, and credentials on affected hosts. Removal of the package alone cannot be assumed to eliminate the malicious software. Any developer or CI environment that installed this package is affected; the only remediation is removal plus host rebuild and credential rotation.
What to do
- Treat any machine with @cecm-web-sdk/core installed or running as fully compromised; rotate all secrets, keys, and credentials from a clean machine immediately
- Remove the package and rebuild/reimage affected developer machines and CI runners from trusted images
- Audit dependency lockfiles, install logs, and npm audit trails to identify where the package was pulled in and block it in registries/proxies
- Review for signs of persistence or exfiltration on affected hosts and check for unauthorized access using stored credentials
Sources
All live incidents on Threat Watch
