GrabCAD (npm @grabcad/* packages): malicious packages published to npm compromise any machine that installs them (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-23
On 2026-10-23 GitHub added four malware advisories for npm packages under the @grabcad scope: @grabcad/user-license (GHSA-6w2v-744r-g5j5), @grabcad/preferences-client (GHSA-mfh5-wvcp-2v6v), @grabcad/company-server-shared (GHSA-fpfw-7wv8-x4mh) and @grabcad/grabcad-shop-shared (GHSA-cc6r-jh8f-6c76). All versions (= 0) are affected, with no patched versions and no known source code, and each is classified CWE-506 embedded malicious code. GitHub's guidance states any computer with these packages installed or running should be considered fully compromised, implying credential and secret theft and potential remote control by an outside entity. Any developer, CI system or build environment that installed any version is affected. There is no fix; removal alone cannot be assumed to eliminate the malware.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine that installed any of these packages, using a clean computer
- Isolate and rebuild affected machines and CI runners from trusted images; do not trust removal of the package alone
- Audit lockfiles, dependency caches and install logs to identify every environment where the packages were installed and what they may have accessed
- Check for persistence, unauthorized access and exfiltration in logs since installation; treat linked cloud/SCM accounts as potentially compromised
- Remove the packages from all projects and block the @grabcad npm scope in dependency firewalls/allowlists
Sources
All live incidents on Threat Watch
