@factoryz/apollo npm package is malware — full machine compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database (GHSA-7q6h-g3hp-prq6, published 2026-11-10) flags the npm package @factoryz/apollo as containing embedded malicious code (CWE-506). All published versions (= 0) are affected and there are no patched versions — the package itself is the attack. GitHub warns that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software it deployed. Any developer or CI environment that installed the package is affected; secrets and keys stored on those machines are at risk. No fix exists; remediation is removal plus incident response.
What to do
- Treat any machine where @factoryz/apollo was installed or run as fully compromised; rotate all secrets and keys from a clean machine
- Remove the package and rebuild/reimage affected hosts and CI runners
- Audit logs and network traffic for signs of attacker access or exfiltration
- Block/avoid the package in npm installs and lockfiles; check dependency trees for it
Sources
All live incidents on Threat Watch
