Malicious npm package jsconvict compromises installers' machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's advisory database published a malware advisory for the npm package jsconvict (GHSA-3c69-7f9m-gpvp) on 2026-11-13. All versions (= 0) are classified as embedded malicious code (CWE-506) with no patched version available. Any machine where the package is installed or running must be considered fully compromised, with potential full control handed to an outside entity. The package sees roughly 27 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to eliminate malicious software it may have installed. No CVE is assigned; the advisory is a malware takedown-style entry with no known source code repository.
What to do
- Rotate all secrets and keys stored on any machine where jsconvict was installed, using a different, clean computer
- Remove jsconvict from all projects and lockfiles and block it in dependency policies
- Rebuild/reimage affected machines; do not assume uninstall removed the malware
- Audit for signs of compromise and credential misuse following key rotation
- Scan dependency trees for other suspicious low-download packages
Sources
All live incidents on Threat Watch
