leveldb-edit (npm): malicious package compromises any machine where installed; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-86wj-q33p-q8r9) for the npm package leveldb-edit, classifying it as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of malicious software. The package is low-reach (~100 downloads/month, 8 GitHub stars) but any installation is treated as a successful compromise. Remediation requires removing the package and rotating all secrets and keys from a clean machine.
What to do
- Treat any machine with leveldb-edit installed as fully compromised; isolate and rebuild it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a different clean computer
- Remove the package from dependencies and lockfiles; audit installs for persistence beyond the package itself
- Check CI/CD and developer environments for the package and any post-install execution artifacts
- Block leveldb-edit in npm installs and monitor for typosquatted variants
Sources
All live incidents on Threat Watch
