dsh-native (npm) — malicious package version 1.4.1 fully compromises installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub's advisory database published a malware advisory for the npm package dsh-native, affecting version 1.4.1. The package contains embedded malicious code (CWE-506), and GitHub states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. All secrets and keys on affected machines should be treated as stolen. No patched or safe version exists; the advisory recommends removal, but notes removal cannot guarantee the machine is clean of follow-on malware. Any developer or CI environment that installed dsh-native 1.4.1 is affected.
What to do
- Rotate all secrets, keys, and credentials stored on machines where dsh-native 1.4.1 was installed, using a clean computer
- Remove dsh-native 1.4.1 from all projects, lockfiles, and CI caches
- Rebuild or wipe affected machines and audit for persistence mechanisms and follow-on malware
- Review npm install logs and CI history to identify when and where the package was pulled
- Block the package in dependency firewalls/registries and audit dependencies for similar typosquat or compromised packages
Sources
All live incidents on Threat Watch
