gpa-core (npm): malicious package fully compromises machines that install it; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub's advisory database published GHSA-g3w4-qv32-7ccr on 2026-11-09 flagging the npm package gpa-core as malware (CWE-506, embedded malicious code). All versions (= 0) are affected and there are no patched versions; the package has no known source code and pulls roughly 422 downloads per month. GitHub states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. Any developer or CI environment that installed gpa-core is affected; secrets and keys on those machines must be treated as stolen. No fix exists — remediation is removal plus credential rotation and host forensics/rebuild.
What to do
- Stop using gpa-core immediately and remove it from all projects, lockfiles and CI pipelines
- Rotate all secrets, keys, tokens and credentials stored on any machine where it was installed, from a clean computer
- Rebuild or forensically clean affected machines; assume full compromise
- Audit logs and network traffic for signs of exfiltration or attacker access
- Check dependencies for typosquatting or other malicious packages before reinstalling
Sources
All live incidents on Threat Watch
