@fcsmc/commercial-analytics npm package is malware — full machine compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database has flagged the npm package @fcsmc/commercial-analytics as containing embedded malicious code (CWE-506). All published versions (= 0) are affected and there are no patched versions — the package itself is the attack. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the machine, enabling theft of secrets, keys and credentials. No source code repository is known. Any developer or CI environment that installed the package is affected; removal of the package alone cannot be assumed to remove the malicious software.
What to do
- Rotate all secrets, keys and credentials stored on any machine where the package was installed, using a different, clean computer
- Remove the package and rebuild/reimage affected machines from trusted images; do not assume removal fully cleans the system
- Audit npm lockfiles and CI logs for any use of @fcsmc/commercial-analytics and block the package
- Review access logs and cloud accounts for signs of compromise since installation
- Notify security teams and rotate tokens exposed in developer or CI environments
Sources
All live incidents on Threat Watch
