internal-renderers (npm): malicious package compromises machines and steals secrets (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
GitHub's advisory database published a malware advisory for the npm package internal-renderers (GHSA-whfc-859g-h5j3) on 2026-11-02. The package, which sees roughly 524 downloads per month, contains embedded malicious code (CWE-506) in every published version (= 0), with no patched versions available. GitHub warns that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removal of the package does not guarantee removal of all malicious software. All developers and CI systems that installed internal-renderers are affected. There is no fix; remediation requires removal, secret rotation from a clean machine, and system rebuild.
What to do
- Rotate all secrets and keys stored on any machine where the package was installed, using a different, uncompromised computer
- Remove internal-renderers from all projects, lockfiles, and CI pipelines; audit dependencies for it
- Rebuild or reimage affected machines and CI runners; assume full compromise
- Review access logs and cloud/registry activity for signs of attacker use
- Block future installs of the package via registry allowlists or policy
Sources
All live incidents on Threat Watch
