Malicious npm package commerce-utils — full system compromise via embedded malware (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-4m72-8w6v-x24q) for the npm package commerce-utils, versions 0.0.1 and 0.0.2, classified as CWE-506 embedded malicious code. The advisory states any computer with the package installed or running should be considered fully compromised, implying attacker control of the machine and access to secrets and keys. There are no patched versions and no known source code; the package (~733 downloads/month) should be treated as malicious rather than a vulnerable dependency. Anyone who installed these versions is affected. Remediation is removal of the package plus rotation of all secrets and keys from a clean machine, since removal cannot guarantee elimination of all malicious software.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a clean computer
- Remove commerce-utils 0.0.1/0.0.2 from all projects and lockfiles and block the package
- Rebuild/reimage affected machines and audit for persistence mechanisms
- Audit logs and systems for signs of attacker access following installation
- Check CI/CD environments and dependency caches for the package
Sources
All live incidents on Threat Watch
