kc-kline-chart (npm): malicious package compromises any machine where it is installed
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published a malware advisory (GHSA-h4xm-rc72-8jph) for the npm package kc-kline-chart on 2026-11-06. All versions (= 0) are affected and no patched version exists; the package is classified as malware (CWE-506, embedded malicious code). Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. Developers and CI systems that installed kc-kline-chart are affected; secrets and keys on those machines are at risk. There is no fix — the only remediation is removal of the package plus host forensics and credential rotation.
What to do
- Rotate all secrets, keys, and credentials stored on machines where kc-kline-chart was installed, using a clean computer
- Remove the package from all projects, lockfiles, and CI caches and block/audit for it
- Rebuild affected machines or containers from trusted images; treat hosts as compromised
- Audit logs and network egress for signs of attacker access following installation
- Scan dependencies for other typosquatted or malicious packages before reinstalling
Sources
All live incidents on Threat Watch
