Malicious npm package @brunosps00/dev-workflow compromises developer machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub's advisory database published a malware advisory for the npm package @brunosps00/dev-workflow, flagging 55 versions (0.0.3 through 2.7.0) as containing embedded malicious code (CWE-506). The package, which sees roughly 590 downloads per month, has no patched versions — every listed release is affected, so removal rather than upgrade is required. The advisory warns that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host, enabling theft of secrets, keys and credentials and persistence beyond simple package removal. No fixed version exists and no source code repository is known. Developers and CI systems that installed any affected version should treat all credentials on those machines as stolen and rotate them immediately.
What to do
- Immediately stop using and uninstall @brunosps00/dev-workflow from all machines and CI runners
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, using a clean computer
- Rebuild/reimage affected machines; do not assume removal of the package removes the malware
- Audit logs and networks for signs of attacker access following installation
- Scan dependency lockfiles and caches for the package and block it in future installs
Sources
All live incidents on Threat Watch
