Malicious npm package @fmr-ap153177/apex-kit-icons — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database flagged the npm package @fmr-ap153177/apex-kit-icons as containing embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists, so any installation grants the attacker full control of the machine. GitHub's guidance states computers with the package installed or running should be considered fully compromised, implying secrets and keys on those machines are exposed. The package sees roughly 852 downloads per month. The advisory was published, reviewed and last updated on 2026-11-10. Removal of the package alone is not guaranteed to eliminate the malicious software it installed. Organisations using this scope should treat affected build machines and developer workstations as breached and rotate all credentials from a clean machine.
What to do
- Remove @fmr-ap153177/apex-kit-icons from all projects and lockfiles
- Rotate all secrets, keys and credentials stored on machines where it was installed, from a clean computer
- Reimage or rebuild affected developer workstations and CI machines
- Audit npm dependencies and block the @fmr-ap153177 scope
- Review logs and endpoints for signs of compromise
Sources
All live incidents on Threat Watch
