Malicious npm package flowbits — full compromise of installed systems (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub published a malware advisory (GHSA-q97r-6qp3-r59x) for the npm package flowbits on 2026-11-11. Every version (= 0) is classified as embedded malicious code with no patched version available. Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software it deployed. All secrets and keys on affected machines are at risk and must be rotated. Any developer, CI pipeline, or end user that installed flowbits from npm is affected. There is no fix — the only remediation is removal plus full incident response on affected hosts.
What to do
- Treat any machine with flowbits installed as fully compromised; isolate and forensically review it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Remove the flowbits package from dependencies, lockfiles, and caches; block it in your registry/proxy
- Rebuild affected systems from trusted images where feasible; audit for persistence and follow-on malware
- Check CI/CD and developer workstations for the package and review what those environments could access
Sources
All live incidents on Threat Watch
