hxqrtv-bznwkp-util: malicious npm package fully compromises machines that install it (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub published a malware advisory (GHSA-rm59-wxgp-7g45) for the npm package hxqrtv-bznwkp-util, versions 0.0.0-stage and 1.0.0. The package is classified as embedded malicious code (CWE-506) with no known source code and no patched versions. GitHub states any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, so removal of the package alone cannot be assumed to remove all malicious software. Any developer, CI system, or end user that installed these versions is affected. There is no fix; remediation is removal plus full incident response including secret rotation and system rebuild.
What to do
- Treat any machine with hxqrtv-bznwkp-util installed as fully compromised; rotate all secrets and keys from a clean computer immediately
- Remove the package and rebuild/reimage affected machines rather than trusting cleanup
- Audit dependency locks and CI caches for the package and block it in registries/proxies
- Review logs and credentials for signs of exfiltration or unauthorized access
Sources
All live incidents on Threat Watch
