Malicious npm package @devmikets/hyperliquid-sdk compromises developer machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub published a malware advisory (GHSA-c2g6-qg53-pvqq) for the npm package @devmikets/hyperliquid-sdk, which impersonates a Hyperliquid trading SDK. All versions (= 0) are affected and no patched version exists; the package embeds malicious code (CWE-506) that gives an outside entity full control of any machine where it is installed or running. Anyone who installed it should treat the computer as fully compromised and rotate all secrets and keys stored on it from a separate, clean machine. Removing the package does not guarantee removal of all malicious software it may have deployed. The advisory was published and reviewed on 2026-11-09; the package sees roughly 280 downloads per month.
What to do
- Immediately rotate all secrets, API keys, and private keys (especially crypto/trading keys) from a clean machine, not the compromised one
- Isolate and rebuild any machine where the package was installed; do not trust removal of the package alone
- Audit npm dependency trees and lockfiles for @devmikets/hyperliquid-sdk and block/remove it
- Review access logs and wallet/exchange accounts for signs of compromise
- Hunt for persistence mechanisms and additional malware the package may have dropped
Sources
All live incidents on Threat Watch
