Malicious npm package idlive-face-capture-web-development — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published a malware advisory (GHSA-84cj-67gm-jqc5, CWE-506 Embedded Malicious Code) for the npm package idlive-face-capture-web-development on 2026-11-03. The package, which appears to impersonate a legitimate face-capture SDK, is classified as fully malicious: any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. All versions (= 0) are affected and no patched version exists. Exploitation is presumed wherever the package was installed; removal alone cannot be guaranteed to eliminate the malicious software. Affected organisations must treat secrets and keys on impacted machines as stolen and rotate them from a clean computer.
What to do
- Treat any machine with the package installed as fully compromised; rotate all secrets and keys stored there immediately, from a different clean computer
- Remove the package and rebuild/reimage affected systems; do not assume removal eliminates the malware
- Audit dependency lockfiles and CI/CD environments for the package and any installs of it
- Review access logs and credentials for signs of exfiltration or attacker access
- Block the package name in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
