@hesxo/viro-cli and @hesxo/forge-cli npm packages are malware — full machine compromise, no safe versions
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub's advisory database published two malware advisories on 2026-11-12 for npm packages @hesxo/viro-cli (GHSA-g2hr-x6gp-2f6r, ~503 downloads/month) and @hesxo/forge-cli (GHSA-h9jx-jh37-w33x, ~8 downloads/month). Every published version (= 0) is classified as embedded malicious code (CWE-506) with no patched versions, meaning any installation grants attackers full control of the machine. GitHub's guidance states any computer with the packages installed or running should be considered fully compromised, with secrets and keys exposed to an outside entity; removal of the package does not guarantee removal of all malicious software. There is no safe version; the only remedy is removal plus full credential rotation and system remediation.
What to do
- Immediately uninstall @hesxo/viro-cli and @hesxo/forge-cli from all machines and CI environments
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, using a clean computer
- Rebuild or thoroughly reimage affected systems; removal of the package does not guarantee removal of all malicious software
- Audit logs and network traffic for signs of exfiltration or attacker access
- Block the packages in npm policies/lockfiles and scan dependency trees for other hesxo packages
Sources
All live incidents on Threat Watch
