@ecg-internal (npm): four packages flagged as malware, full compromise of affected machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-23
On 2026-10-23 GitHub published four malware advisories covering every published version of four npm packages under the @ecg-internal scope: js-react-i18n (GHSA-5x9g-7rj9-4xc8), adobe-dmp-js (GHSA-vcj4-3hxm-4rf3), media-util-js-lib (GHSA-hcw5-m6mm-qg3q), and aurora-js-formatters (GHSA-9976-3w38-mrmj). All are rated critical with CWE-506 (embedded malicious code), no known source code, and no patched versions — the packages themselves are the malware. GitHub's guidance states any machine with these packages installed or running should be considered fully compromised, implying attackers may have obtained full control, harvested secrets and keys, and installed additional malicious software. Any project depending on these packages is affected; removal alone may not eradicate the compromise.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine
- Remove the packages from all projects and lockfiles and audit for persistence mechanisms or additional malware left behind
- Rebuild or thoroughly forensically clean affected machines; treat them as attacker-controlled
- Check CI/CD pipelines and build artifacts for use of these packages and re-run builds from clean environments
- Audit npm dependency trees for other packages from the @ecg-internal scope or similar typosquats and block them
Sources
All live incidents on Threat Watch
