hissakdx-wix-ssr-callback-canary (npm): malicious package compromises any machine where it is installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's Advisory Database published GHSA-pmjf-g9mp-9hrr on 2026-11-10 flagging the npm package hissakdx-wix-ssr-callback-canary as malware (CWE-506, embedded malicious code). All versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. The package sees roughly 1190 downloads per month. There is no fix; remediation requires removing the package, rotating all secrets and keys from a clean machine, and rebuilding compromised systems.
What to do
- Remove hissakdx-wix-ssr-callback-canary from all projects and lockfiles and block it in your registry/proxy
- Rotate all secrets, keys, and credentials stored on any machine where it was installed, using a clean computer
- Rebuild or reimage affected machines; do not trust that removal removed the malware
- Audit npm dependency trees and CI caches for the package and review logs for signs of compromise
Sources
All live incidents on Threat Watch
