@factiii/runner: npm package flagged as malware, full host compromise (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-22
GitHub's advisory database (GHSA-9j83-qj34-g5vc, published 2026-10-22) flags the npm package @factiii/runner version 0.28.0 as embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines should be treated as stolen. No patched version exists and no known source code is listed. Anyone who installed @factiii/runner 0.28.0 is affected. The only remediation is removal of the package plus credential rotation and host forensics, since removal cannot guarantee all malicious software is eliminated.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from machines where @factiii/runner 0.28.0 was installed, using a clean machine
- Remove the package and rebuild/reimage affected hosts; do not trust removal alone
- Audit install logs and CI/CD systems for use of @factiii/runner 0.28.0 and check for persistence or unauthorized access
- Block the package in dependency management and lockfile policies; scan repositories for references
Sources
All live incidents on Threat Watch
