@kibt/www-nuxt-i18n: npm package flagged as malware, all versions compromised (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-23
GitHub's advisory database published GHSA-2c7v-rmgw-3xrp on 2026-10-23 flagging the npm package @kibt/www-nuxt-i18n as malware (CWE-506, embedded malicious code). All versions (= 0) are affected and no patched versions exist; the package appears to be a typosquat-style malicious imitation of nuxt-i18n with no known source code. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying credential and secret theft by an outside party. Anyone who installed it via npm is affected. There is no fix beyond removal and remediation of the compromised host.
What to do
- Remove @kibt/www-nuxt-i18n from all projects and lockfiles and block the package in your registry/proxy allowlists
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean machine
- Rebuild affected machines or containers from trusted images; do not assume removal of the package removes the malware
- Audit npm install logs and CI pipelines for installs of the package and check for follow-on attacker activity
- Switch to the legitimate nuxt-i18n package from a verified source
Sources
All live incidents on Threat Watch
