Malicious npm package evmos-contracts — full host compromise, no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published advisory GHSA-ch75-7hv2-w5hw on 2026-11-06 flagging the npm package evmos-contracts as malware (CWE-506, Embedded Malicious Code). Every published version (= 0) is affected and no patched version exists, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. Secrets and keys stored on affected machines are at risk. Exploitation details and in-the-wild spread are not stated. Remediation is incident response, not upgrading: remove the package and rotate all credentials from a clean machine.
What to do
- Treat any machine where evmos-contracts was installed or run as fully compromised; isolate and forensically review it
- Rotate all secrets, keys, tokens and credentials stored on affected machines, from a clean computer
- Remove the package and rebuild affected systems from trusted images; do not assume removal fully cleans the host
- Audit dependency lockfiles and CI pipelines for evmos-contracts and block its installation
- Review for signs of unauthorized access or persistence and monitor related accounts
Sources
All live incidents on Threat Watch
