@crvouga/mockingbird-service-microsoft npm package contains malware (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-15
GitHub published advisory GHSA-w3gq-mm9x-7w7c on 2026-11-15 flagging version 0.14.0 of the npm package @crvouga/mockingbird-service-microsoft as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with attacker control implying potential theft of secrets, keys, and credentials. The package has roughly 2,839 monthly downloads and 4 GitHub stars, so exposure is limited but real. No patched version exists and no source code is available; the advisory recommends removal, but removal alone cannot guarantee the machine is clean since full control may have been handed to an outside entity. Affected users must treat the host as compromised, rotate all secrets from a separate machine, and rebuild the environment.
What to do
- Stop using and uninstall @crvouga/mockingbird-service-microsoft 0.14.0 immediately
- Treat all machines that ran the package as fully compromised; rotate all secrets and keys from a clean computer
- Rebuild/reimage affected hosts and audit for persistence and attacker access
- Review CI/CD and developer machines that installed the package for credential exposure
- Block the package in dependency policies and check lockfiles for the dependency
Sources
All live incidents on Threat Watch
