Malicious npm package @2oolkit/hyperliquid-cli — full machine compromise, credential theft (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's advisory database published GHSA-qg83-c6x5-qw8f on 2026-11-10 flagging the npm package @2oolkit/hyperliquid-cli as malware (CWE-506, embedded malicious code). Versions 0.1.0 through 0.2.7 are affected and there are no patched versions — the package cannot be safely used at all. The advisory states any computer with the package installed or running should be considered fully compromised, implying attackers may have obtained full control, exfiltrated secrets and keys, and installed additional malicious software that removal of the package will not eliminate. The package appears to be a typosquat-style fake CLI targeting Hyperliquid crypto users, with roughly 2,671 monthly downloads. No CVE is assigned; remediation is incident response, not patching.
What to do
- Rotate all secrets, API keys, wallet keys and credentials stored on any machine where the package was installed, using a clean computer
- Rebuild or wipe affected machines; do not rely on uninstalling the package
- Audit for persistence, additional malware and signs of crypto-wallet or exchange compromise
- Block/remove the package from dependency trees and lockfiles; check CI systems for exposure
- Review logs for outbound connections or exfiltration since installation
Sources
All live incidents on Threat Watch
