@gemshell/win32-x64 npm package is malware — full machine compromise for installers of v1.2.1
Severity: critical · Patch status: no-fix-needed · Since 2026-11-05
GitHub's malware advisory database flagged the npm package @gemshell/win32-x64 version 1.2.1 as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated from a clean computer. There are no patched versions and no known source code — the package is malware, so remediation is removal plus incident response, not an upgrade. Anyone who installed version 1.2.1 is affected; the advisory was published and reviewed on 2026-11-05.
What to do
- Treat any machine with @gemshell/win32-x64@1.2.1 installed as fully compromised; isolate it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Remove the package and rebuild/reimage affected systems; do not assume removal clears the malware
- Audit dependency trees and CI caches for the package and block it in npm registries/proxies
Sources
All live incidents on Threat Watch
