Malicious npm package @i18n.site/cli-win32-x64 0.1.10 — full machine compromise; rotate secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's malware advisory database flagged the npm package @i18n.site/cli-win32-x64 version 0.1.10 as containing embedded malicious code (CWE-506). Any machine where the package was installed or executed should be considered fully compromised, with attacker control of the system and access to stored secrets and keys. No patched version exists; the advisory recommends removal of the package and immediate rotation of all secrets and keys from a clean machine, noting removal alone cannot guarantee eradication of the malicious software. Affected users are developers on Windows who installed this platform-specific binary package, likely as a dependency of the i18n.site tooling.
What to do
- Rotate all secrets, keys, and credentials stored on any machine that installed the package, using a different clean computer
- Remove @i18n.site/cli-win32-x64 0.1.10 from all systems and lockfiles
- Rebuild/reimage affected machines; do not assume removal fully cleans the system
- Audit for signs of compromise and review npm dependency trees for other i18n.site packages
Sources
All live incidents on Threat Watch
