Malicious npm package itc-actors-api — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-05
GitHub published a malware advisory (GHSA-w2fv-53fr-6qwg) on 2026-11-05 for the npm package itc-actors-api, flagging it as embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, so removal of the package alone cannot be assumed to remove all malicious software. Any developer, CI system, or end user that installed the package is affected; secrets and keys on those machines are presumed stolen. No fix will be issued; remediation is removal plus incident response.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from any machine where itc-actors-api was installed, using a clean machine
- Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the system
- Audit dependency lockfiles, CI caches, and artifacts for itc-actors-api and block it in registries/proxies
- Review access and network logs for signs of attacker activity following installation
- Notify downstream users if the package entered your published artifacts
Sources
All live incidents on Threat Watch
