@jelou/cli-win32-x64 npm package: malicious code compromises any machine where version 4.26.1 is installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub published advisory GHSA-q78g-75cg-hwq6 on 2026-11-13 flagging @jelou/cli-win32-x64 version 4.26.1 on npm as malware (CWE-506, embedded malicious code). The advisory states any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. The package draws ~5,865 downloads per month, so a meaningful number of Windows developer machines may be affected. There is no patched version and no known source code; the package should be treated as malicious rather than a compromised legitimate project. Remediation requires removing the package, rotating all secrets and keys from a clean machine, and forensic cleanup, since removal alone cannot be guaranteed to eliminate implanted malware.
What to do
- Treat any machine with @jelou/cli-win32-x64 4.26.1 installed as fully compromised; isolate it
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Remove the package and run malware/forensic cleanup; reimage if in doubt
- Audit npm lockfiles and CI caches for the package and block it in registry proxies
- Review logs for post-compromise activity and credential use
Sources
All live incidents on Threat Watch
