Malicious npm package @camera.ui/camera-ui-nvr-windows-amd64 1.6.1 fully compromises hosts
Severity: critical · Patch status: no-fix-needed · Since 2026-10-27
GitHub's malware advisory database published GHSA-2w7v-jwxh-w7wc on 2026-10-27 flagging the npm package @camera.ui/camera-ui-nvr-windows-amd64 version 1.6.1 as embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity. The package draws roughly 1,456 downloads per month, so some Windows users of the camera.ui NVR ecosystem may have installed it. There are no patched versions and no known source code; the only remedy is removal plus full incident response, since uninstalling cannot be assumed to remove all malicious software. Secrets and keys on affected machines must be rotated from a clean computer.
What to do
- Treat any machine with the package installed or running as fully compromised; isolate it immediately
- Rotate all secrets, keys, and credentials stored on affected machines from a different, clean computer
- Remove the package and rebuild/reimage affected systems; do not assume removal eliminates the malware
- Audit install logs and dependency trees for the package and block it in registries/CI
- Review Windows NVR/camera.ui hosts for persistence and signs of outside access
Sources
All live incidents on Threat Watch
