kbmathlessons npm package is malware — full machine compromise, no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub's advisory database published a malware advisory (GHSA-8cvx-wq76-pcwg, CWE-506 Embedded Malicious Code) for the npm package kbmathlessons. Every version (= 0) is affected and there are no patched versions — the package itself is malicious, so no fix exists. GitHub states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets, keys, and credentials stored on the machine. Removal of the package does not guarantee removal of any malicious software it may have installed. All developers or CI systems that installed kbmathlessons are affected; the advisory was published and reviewed on 2026-11-11.
What to do
- Rotate all secrets, keys, tokens, and credentials stored on any machine where kbmathlessons was installed, using a different, clean computer
- Rebuild or wipe affected machines and CI runners rather than just uninstalling the package
- Audit systems for signs of compromise and persistence mechanisms left by the malware
- Check dependency trees and lockfiles for kbmathlessons and block/reject the package in future installs
Sources
All live incidents on Threat Watch
