Malicious npm package buyerdashboard — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's malware advisory database published GHSA-gg3j-f9ff-vx42 on 2026-11-03 flagging the npm package buyerdashboard as embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists — the package itself is the attack. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside actor, exposing secrets, keys and credentials. There is no remediation via upgrade; the only action is removal plus full credential rotation and system rebuild, since removal cannot guarantee all implanted malware is gone. Any developer or CI environment that installed buyerdashboard is affected.
What to do
- Rotate all secrets, keys and credentials stored on any machine where buyerdashboard was installed, using a clean machine
- Remove the package and rebuild/reimage affected machines; do not trust the existing environment
- Audit install logs, CI caches and lockfiles for buyerdashboard and block it in registries/proxies
- Review access logs and network activity for signs of attacker control
- Notify downstream users if the package entered your dependency tree
Sources
All live incidents on Threat Watch
