Malicious npm package @generic-means/ing-feat-scanner-libs — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's advisory database published a malware advisory (GHSA-77gv-vj6m-6qg6) for the npm package @generic-means/ing-feat-scanner-libs, flagged as CWE-506 embedded malicious code. All published versions (= 0) are affected and no patched version exists. The advisory warns that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the machine. Secrets and keys stored on affected machines are at risk and must be rotated. There is no indication of a specific victim organisation; impact depends on who installed the package. Removal of the package alone is not guaranteed to eliminate the malicious software. No fix is available; the only remediation is removal plus host forensics and credential rotation.
What to do
- Remove @generic-means/ing-feat-scanner-libs from all projects and dependency trees immediately
- Treat affected machines as fully compromised: rotate all secrets, keys, and credentials from a clean computer
- Rebuild or reimage affected hosts; do not assume package removal removes the malware
- Audit npm lockfiles and CI caches for the package and block it in dependency scanning
- Review access and activity logs for signs of attacker control
Sources
All live incidents on Threat Watch
