health-relay-client (npm): malicious package versions 1.0.3–1.0.4 fully compromise installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's advisory database published a malware advisory for the npm package health-relay-client, flagging versions 1.0.3 and 1.0.4 as containing embedded malicious code (CWE-506). GitHub's standard malware wording states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. There are no patched versions and no known source code repository; the package sees roughly 171 downloads per month. Any developer or CI system that installed these versions should assume secret and key theft and treat removal of the package as insufficient to guarantee remediation. The advisory was published and reviewed on 2026-11-10.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where health-relay-client 1.0.3 or 1.0.4 was installed, doing so from a clean computer
- Remove the package and rebuild/reimage affected machines and CI runners from trusted images
- Audit systems for signs of compromise and review logs for exfiltration or persistence
- Block health-relay-client in dependency policies and check lockfiles and dependency trees for the affected versions
Sources
All live incidents on Threat Watch
