Malicious npm package automic-style-engine — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub's advisory database published GHSA-96vr-mq8q-pxcc on 2026-11-06 flagging the npm package automic-style-engine as embedded malware (CWE-506). All versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; secrets and keys stored on affected machines must be rotated. Removal of the package does not guarantee removal of all malicious software it installed. Anyone who installed the package is affected; exploitation is inherent to installation.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine
- Remove the package and rebuild/reimage affected systems from trusted sources
- Audit systems for persistence mechanisms and other malicious software left behind
- Check dependency trees and lockfiles for automic-style-engine and block it in CI/CD and registries
Sources
All live incidents on Threat Watch
