glyphmatrix-fixture (npm): malicious package versions 1.0.0 and 1.0.1 fully compromise installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
GitHub published advisory GHSA-vc33-3x34-x6jm on 2026-10-28 flagging the npm package glyphmatrix-fixture as malware (CWE-506, embedded malicious code). Versions 1.0.0 and 1.0.1 are affected and there are no patched versions; the advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected machines should be treated as stolen. The package has no known source code repository. Removal of the package alone is not guaranteed to eliminate malicious software installed by it. Any developer or CI environment that installed these versions is affected.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from machines where glyphmatrix-fixture was installed, using a clean computer
- Remove glyphmatrix-fixture from all projects, lockfiles, and CI caches and rebuild affected environments from trusted images
- Audit affected machines for persistence and other malicious software; reimage if compromise is suspected
- Check dependency histories and CI logs for any installation of the package
- Block the package name in internal registries and dependency firewalls
Sources
All live incidents on Threat Watch
