@liauto npm packages (linux-arm64, linux-x64, darwin-arm64, cli) — malware, full host compromise, no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub's advisory database published four malware advisories on 2026-11-09 for the @liauto npm packages: linux-arm64, linux-x64, darwin-arm64, and cli. All versions (= 0) are flagged as containing embedded malicious code (CWE-506) with no patched versions available. The advisories state any machine with these packages installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host, enabling secret and credential theft. Combined downloads are roughly 3,500/month, so exposure is limited but real. Removal of the packages alone is not guaranteed to eliminate the malicious software. No CVEs are assigned; remediation is host-level incident response and credential rotation.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from any machine where these packages were installed, using a clean machine
- Remove the @liauto packages and rebuild/reimage affected hosts; do not assume removal fully cleans the system
- Audit CI/CD runners, developer machines, and containers for the packages and for signs of compromise
- Check lockfiles and dependency trees for @liauto packages and block them in registry proxies/allowlists
- Review access logs and network egress for indicators of compromise since installation
Sources
All live incidents on Threat Watch
