Malicious npm package @futurae-public/adaptive-js — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published advisory GHSA-xcfm-cvqm-rcwc on 2026-11-10 flagging the npm package @futurae-public/adaptive-js as malware (CWE-506, Embedded Malicious Code). All versions (= 0) are affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, implying the malicious code grants outside actors full control of the machine, exposing secrets, keys and credentials. Any developer or CI environment that installed the package is affected. There is no fix; remediation consists of removing the package and rotating all secrets from a clean machine, as removal alone cannot guarantee the malware is eradicated.
What to do
- Treat any machine where the package was installed or executed as fully compromised; rebuild from clean images
- Rotate all secrets, keys, tokens and credentials stored on affected machines, using a different clean computer
- Remove the package from all projects, lockfiles and CI pipelines and block it from being installed again
- Audit logs and network traffic for signs of exfiltration or attacker access
- Investigate for persistence mechanisms and residual malicious software before restoring trust in the systems
Sources
All live incidents on Threat Watch
