@db-tools/main-app (npm) — malicious package compromises any machine where it is installed
Severity: critical · Patch status: no-fix-needed · Since 2026-11-05
GitHub's malware advisory database published GHSA-fwf6-6x3c-6g3h on 2026-11-05 flagging the npm package @db-tools/main-app as embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists. GitHub states that any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity; secrets and keys stored on affected machines are at risk. Removal of the package alone is not guaranteed to remove all malicious software it installed. Any developer, CI system, or production environment that pulled this package from npm is affected. There is no fix; remediation is removal plus credential rotation and host forensics/rebuild.
What to do
- Remove @db-tools/main-app from all projects, lockfiles, and CI pipelines immediately
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using an uninfected computer
- Rebuild or forensically clean affected hosts; do not assume package removal fully removes the malware
- Audit npm dependency trees and lockfiles for the package and any related suspicious dependencies
- Review access logs and monitor for suspicious activity from affected systems
Sources
All live incidents on Threat Watch
