Malicious npm package canta-baileys — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub's malware advisory database flagged the npm package canta-baileys as containing embedded malicious code (CWE-506), published 2026-11-04. All versions (= 0) are affected and no patched version exists — the package itself is the malware. Any machine where it is installed or running must be considered fully compromised, with potential attacker control enabling theft of secrets, keys, and credentials and persistence beyond simple package removal. Anyone who installed the package via npm is affected. There is no fix; remediation is removal plus full incident response on affected hosts.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a clean computer
- Remove the canta-baileys package and audit affected hosts for persistence, as removal alone may not eliminate the malware
- Rebuild/reimage compromised machines from trusted media
- Audit dependency trees and lockfiles for canta-baileys and block it in CI/CD and registry proxies
Sources
All live incidents on Threat Watch
