Malicious npm package dsh-plugin-blender-3d — full machine compromise for installers (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
GitHub's malware advisory database published GHSA-hw9g-f63g-4c8x on 2026-10-28 flagging the npm package dsh-plugin-blender-3d version 0.2.1 as embedded malicious code (CWE-506). Any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. There is no patched version and no known source code; the only remediation is removal, which may not eliminate all malicious software. Roughly 163 downloads per month are recorded. Anyone who installed version 0.2.1 should treat secrets and keys on the affected machine as stolen and rotate them from a clean computer.
What to do
- Rotate all secrets, keys, and credentials stored on any machine that installed the package, using a different clean computer
- Remove dsh-plugin-blender-3d 0.2.1 from all systems and CI environments
- Rebuild or reimage affected machines; removal may not eliminate all malicious software
- Audit npm lockfiles and dependency trees for the package and block it in registries/proxies
- Review logs and network traffic for signs of attacker access following installation
Sources
All live incidents on Threat Watch
