Malicious npm package fapshi 1.1.4 — full system compromise; no patched version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-frmh-w7mm-6h56) on 2026-11-10 for the npm package fapshi, version 1.1.4, classified under CWE-506 Embedded Malicious Code. Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No patched version exists, so the only remediation is removal of the package plus incident response. The package sees roughly 103 downloads per month, so exposure is limited but real. Secrets and keys on affected machines must be treated as stolen and rotated from a clean computer, since removing the package cannot guarantee removal of all malicious software it may have deployed.
What to do
- Treat any machine with fapshi 1.1.4 installed as fully compromised; isolate it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Remove the fapshi package and rebuild/reimage affected systems rather than trusting cleanup
- Audit dependency lockfiles and CI environments for fapshi and block its installation
- Review logs and network traffic for signs of exfiltration or attacker access
Sources
All live incidents on Threat Watch
