Malicious npm package hauntview 0.2.9 — full system compromise of installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's malware advisory database flagged the npm package hauntview version 0.2.9 as containing embedded malicious code (CWE-506), published 2026-11-13. Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside actor. All secrets and keys stored on affected machines must be rotated from a clean computer. There are no patched versions — the package itself is malware — and removal does not guarantee elimination of all malicious software it may have installed. Users who installed hauntview 0.2.9 are affected; no fixed version exists, so the only remediation is removal plus full incident response on affected hosts.
What to do
- Remove hauntview 0.2.9 from all projects and machines
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild or reimage affected systems; scan for persistence and additional malware
- Audit npm lockfiles and CI environments for the package and review access logs for signs of compromise
Sources
All live incidents on Threat Watch
