itsa-utils / itsa-react-checkbox npm packages trojanized with malware (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
GitHub's advisory database published malware advisories on 2026-10-28 for two npm packages from the itsa ecosystem: itsa-utils version 1.4.2 and itsa-react-checkbox version 16.0.5, both flagged as embedded malicious code (CWE-506). Any machine with these packages installed or running should be considered fully compromised, with attacker control of the host implying potential theft of secrets, keys, and credentials. No patched versions exist; the packages have no known source code for remediation. itsa-utils has roughly 2,735 weekly downloads and 32 dependent repositories, so downstream projects may be exposed transitively. Removal of the packages alone cannot guarantee removal of all malicious software deployed during compromise.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from any machine that installed these packages, using a clean machine
- Remove itsa-utils@1.4.2 and itsa-react-checkbox@16.0.5 from all projects and lockfiles, pinning to known-clean versions
- Rebuild/reimage affected machines and audit for persistence mechanisms, as removal may not eliminate implanted malware
- Check transitive dependencies (32 dependent repos for itsa-utils) and audit CI/CD systems for exposure
- Block these package versions in registries/proxies and monitor for related itsa packages being trojanized
Sources
All live incidents on Threat Watch
