Malicious npm package css-import-order — full system compromise for installers (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database published GHSA-wc5q-g53w-pg32 on 2026-11-10 flagging the npm package css-import-order as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists; the package should not be used under any circumstances. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets and keys. Reach appears limited (~172 downloads/month), but any installation is treated as a successful compromise. There is no fix — remediation consists of removing the package and rotating all credentials from a clean machine, since removal alone cannot guarantee the malware is eradicated.
What to do
- Treat any machine with css-import-order installed as fully compromised; isolate and rebuild it
- Rotate all secrets, keys, and credentials stored on affected machines, from a different clean computer
- Remove the package from dependencies and lockfiles; block it in CI and dependency firewalls
- Audit build systems and developer machines for the package and signs of follow-on malware
- Review npm install logs and CI history to identify when and where it was installed
Sources
All live incidents on Threat Watch
