Malicious npm package bfvkjmeikpwhqxc — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
GitHub published a malware advisory (GHSA-pg3x-mr83-5crv) on 2026-11-02 for the npm package bfvkjmeikpwhqxc, flagging versions 0.0.0-stage, 1.0.0 and 1.0.1 as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of the malicious software. No patched versions exist and no source code is known. Any developer or CI environment that installed the package is affected; secrets and keys on those machines must be treated as stolen.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where the package was installed, using a clean machine
- Remove the package from all projects, lockfiles and CI caches
- Rebuild or wipe affected machines and CI runners; audit for persistence
- Review access and network logs for signs of exfiltration or attacker activity
Sources
All live incidents on Threat Watch
