Malicious npm package ctf-agent 0.1.0 — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub's advisory database published a malware advisory (GHSA-2j3v-rjgw-5wgg) for the npm package ctf-agent, version 0.1.0, flagged as CWE-506 embedded malicious code. Per the advisory, any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected machines must be rotated from a clean computer. There are no patched versions and no known source code; removal of the package does not guarantee removal of all malicious software. Anyone who installed ctf-agent 0.1.0 is affected.
What to do
- Rotate all secrets and keys stored on any machine where ctf-agent was installed, using a different clean computer
- Remove ctf-agent from all systems and dependencies
- Rebuild/reimage affected machines; do not assume removal fully cleans them
- Audit dependency lockfiles and CI environments for ctf-agent installs
- Block the package in npm registries and internal mirrors
Sources
All live incidents on Threat Watch
