@jm-telefonica/multibrand-components npm package contains malware — full machine compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database flagged the npm package @jm-telefonica/multibrand-components as containing embedded malicious code (CWE-506), published 2026-11-10. Every published version (= 0) is affected and no patched version exists, so any installation should be treated as a deliberate compromise rather than a vulnerable dependency. The advisory warns that any computer with the package installed or running should be considered fully compromised, with attackers potentially holding full remote control, and that removing the package cannot guarantee removal of all malicious software it deployed. Reach appears limited (~814 downloads/month), but anyone who installed it is exposed to secret and key theft. There is no fix; remediation is removal plus credential rotation and host forensics.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from any machine where the package was installed, using a clean machine
- Remove the package from all projects and lockfiles and audit for persistence mechanisms it may have deployed
- Rebuild/reimage affected machines and review access logs for signs of attacker activity
- Audit CI/CD environments and dependency caches for the package and block it in registry allowlists
Sources
All live incidents on Threat Watch
