@ewms/el-bootstrap npm package is malware — full machine compromise for any version installed
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's advisory database has flagged the npm package @ewms/el-bootstrap as malware (GHSA-v22r-22vf-5p3c, CWE-506), published 2026-11-13. Every version (= 0) is affected and there are no patched versions — the package itself is the attack. Any computer where it is installed or running should be considered fully compromised, with control potentially handed to an outside entity. All developers, CI systems, and build machines that pulled the package are in scope. Removal of the package does not guarantee removal of the malicious software it may have deployed. No fix exists; remediation is incident response, not upgrading.
What to do
- Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a clean computer
- Remove @ewms/el-bootstrap from all projects, lockfiles, and CI pipelines
- Rebuild or forensically clean affected machines; do not assume package removal removes the malware
- Audit npm dependency trees and lockfiles for the package and any related suspicious dependencies
- Review access logs and monitor for signs of attacker activity on affected hosts
Sources
All live incidents on Threat Watch
