celest-browser (npm): malicious package compromises any machine where installed; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's malware advisory database flagged the npm package celest-browser as containing embedded malicious code (CWE-506), published 2026-11-13. All versions (= 0) are affected and no patched version exists; the package has no known source code repository. GitHub states any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity. The package sees roughly 407 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software it installed. No CVE is assigned; this is a malware takedown-style advisory rather than a code vulnerability.
What to do
- Rotate all secrets and keys stored on any machine where celest-browser was installed, using a different, clean computer
- Remove celest-browser from all projects and lockfiles and block it in dependency policies
- Rebuild/reimage affected machines; do not assume uninstall removed the malware
- Audit for signs of compromise and review CI/CD and developer machines that may have pulled the package
Sources
All live incidents on Threat Watch
