Malicious nicegui npm package — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-q452-fhw8-f2rp) on 2026-11-10 for the npm package nicegui, flagging it as containing embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected machines should be rotated immediately from a different, uncompromised computer. Removal of the package is recommended but may not remove all malicious software planted during installation. Organisations that installed the package should treat hosts as breached and rebuild them.
What to do
- Immediately rotate all secrets, keys, and credentials stored on or accessible from machines where the package was installed, using a clean computer
- Remove the nicegui npm package from all systems and block it in dependency management
- Rebuild or reimage affected machines; do not assume removal of the package eliminates the malware
- Audit systems for signs of compromise and unauthorised access or persistence
- Review CI/CD and developer environments for exposure to the package and rotate pipeline credentials
Sources
All live incidents on Threat Watch
