@htooayelwinict/travis234 npm malware: full machine compromise for users of version 3.3.2 (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-08
GitHub's malware advisory database flagged the npm package @htooayelwinict/travis234 version 3.3.2 as containing embedded malicious code (CWE-506). GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying the malware grants attackers full control of the machine, enabling theft of secrets, keys and credentials. No patched version exists and the package should simply be removed, though removal cannot guarantee the malicious software is fully eradicated. The package sees roughly 1,369 downloads per month, so exposure is limited but real. Developers who installed version 3.3.2 should treat all credentials on affected machines as stolen and rotate them from a clean computer.
What to do
- Stop using and uninstall @htooayelwinict/travis234 3.3.2 immediately
- Consider any machine that ran the package fully compromised; rebuild or thoroughly clean it
- Rotate all secrets, keys, tokens and credentials stored on affected machines, from a different clean computer
- Audit for persistence mechanisms and residual malware, since removal of the package may not remove all malicious software
- Check dependency trees and CI systems for the package and block it
Sources
All live incidents on Threat Watch
