Malicious npm package ioredis-om-typed — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub's advisory database published a malware advisory (GHSA-66fx-r7cm-jxv6) for the npm package ioredis-om-typed, flagged as embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists — the package itself is the attack. Any machine with the package installed or running should be treated as fully compromised, with the attacker potentially holding full control and access to secrets, keys, and credentials on that machine. Removal of the package does not guarantee removal of any malicious software it may have deployed. All developers and CI systems that installed the package are affected; there is no fix other than removal plus full incident response.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a clean machine
- Remove ioredis-om-typed from all projects, lockfiles, and CI caches
- Rebuild affected machines/containers from trusted images; investigate for persistence and deployed malware
- Audit logs and network egress for signs of attacker access
- Block the package in npm/registry policy and dependency scanning
Sources
All live incidents on Threat Watch
