Malicious npm package arc-contracts — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published a malware advisory (GHSA-qcjv-pgw5-h2f5) for the npm package arc-contracts on 2026-11-06. All versions (= 0) are affected and no patched version exists; the package is classified as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. Secrets and keys stored on affected machines are at risk. Removal of the package does not guarantee removal of all malicious software planted during installation. No fix is available; the only safe action is removal plus full credential rotation and system rebuild.
What to do
- Rotate all secrets, keys, and credentials stored on machines where arc-contracts was installed, from a clean machine
- Remove the arc-contracts dependency and purge it from lockfiles and caches
- Rebuild/reimage affected machines; do not assume removal cleans the system
- Audit for persistence, unauthorized access, and exfiltration since installation
- Block the package in dependency policies and CI to prevent reinstallation
Sources
All live incidents on Threat Watch
