data-sync-utils (npm): malicious package compromises any machine where it is installed; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub's malware advisory database has flagged the npm package data-sync-utils as embedded malicious code (CWE-506), published 2026-11-04. Every version (= 0) is affected and no patched version exists. Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. All secrets and keys on affected machines must be rotated from a clean computer. Any developer, CI system, or deployment that installed data-sync-utils at any version is affected.
What to do
- Treat any machine that installed or ran data-sync-utils as fully compromised; rebuild from trusted images
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Audit npm lockfiles and CI caches for data-sync-utils and block/remove it from registries and pipelines
- Review logs and network traffic for signs of exfiltration or attacker access
- Force credential resets (npm, git, cloud tokens) for users on affected hosts
Sources
All live incidents on Threat Watch
