Malicious npm package @fmr-ap149494/apex-base-component — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database flagged the npm package @fmr-ap149494/apex-base-component as embedded malicious code (CWE-506), published 2026-11-10. All versions (= 0) are affected and no patched version exists; the package should not be used at all. Per the advisory, any computer where the package was installed or run should be considered fully compromised, implying the malware grants outside attackers control of the machine, exposing secrets, keys and credentials. Anyone who installed the package as a dependency is affected. There is no fix beyond removal; remediation requires rotating all secrets from a clean machine and forensic review, since removal of the package cannot guarantee removal of all malicious software it deployed.
What to do
- Rotate all secrets, keys and credentials stored on any machine where the package was installed, using a different clean computer
- Remove the package from all projects and lockfiles and block/audit for it in npm dependencies
- Rebuild affected machines or perform forensic cleanup, as removal may not eliminate all malicious software
- Review CI/CD and developer environments for compromise and audit access logs
Sources
All live incidents on Threat Watch
