Malicious npm package ccb-app-ui-service — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published a malware advisory (GHSA-fpx9-gqqh-c483) for the npm package ccb-app-ui-service, flagged as CWE-506 embedded malicious code. All versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Anyone who installed or ran the package is affected. Removal of the package alone is not guaranteed to remove all malicious software. No CVE is assigned; the advisory was published and reviewed on 2026-11-06.
What to do
- Rotate all secrets and keys stored on any machine where the package was installed or run, using a different, clean computer
- Isolate and rebuild affected machines from trusted images rather than just uninstalling the package
- Audit dependency trees and CI/CD environments for ccb-app-ui-service and block/remove it from registries and lockfiles
- Review logs and credentials for signs of exfiltration or unauthorized access
- Harden npm install pipelines with malware scanning and allowlists
Sources
All live incidents on Threat Watch
