future-scripts (npm): package confirmed as malware — full machine compromise, no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub's malware advisory database has flagged the npm package future-scripts as malicious (GHSA-5j4v-g9j4-3f38, CWE-506). Every published version (= 0) is affected and there are no patched versions, meaning any installation results in full compromise of the host machine and potential handover of control to an outside entity. The advisory instructs that any computer with the package installed or running should be considered fully compromised, with all secrets and keys rotated from a separate machine. The package sees roughly 713 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to eliminate all malicious software it may have deployed. No fix will be issued; the only remediation is removal plus incident response.
What to do
- Treat any machine with future-scripts installed as fully compromised; rotate all secrets and keys from a clean machine
- Remove the package and audit for persistence mechanisms, as removal may not eliminate all malicious software
- Check lockfiles and CI pipelines for the dependency and rebuild affected environments from trusted images
- Review access logs and credentials accessible from compromised hosts for signs of exfiltration
Sources
All live incidents on Threat Watch
