jailbreak-code (npm): malicious package compromises any machine where it is installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's malware advisory database published GHSA-fmpq-536x-fhwq on 2026-11-03 flagging the npm package jailbreak-code as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists; the package has no known source code repository. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, so removal alone may not eliminate the malicious software. Any developer, CI system, or end user that installed jailbreak-code from npm is affected. There is no fix; remediation consists of removing the package and rotating all secrets and keys from a clean machine.
What to do
- Treat any machine with jailbreak-code installed as fully compromised; rotate all secrets and keys immediately from a different, clean computer
- Audit npm lockfiles, CI caches, and developer machines for jailbreak-code and remove it
- Rebuild affected systems from trusted images rather than assuming removal is sufficient
- Review logs and credentials for signs of exfiltration or unauthorized access
- Block the package in internal registries and dependency-scanning tooling
Sources
All live incidents on Threat Watch
