Malicious npm package @kora20030101/test-pkg-delete-me — full host compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published a malware advisory (GHSA-g42p-gwv6-w549) for the npm package @kora20030101/test-pkg-delete-me, flagged under CWE-506 (embedded malicious code). All published versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, so removal of the package alone cannot be assumed to remove all malicious software. Anyone who installed the package — directly or as a transitive dependency — is affected. The package has no known source code repository. Remediation is incident response, not an upgrade: remove the package, rotate all secrets and keys from a clean machine, and rebuild/reimage affected hosts.
What to do
- Remove @kora20030101/test-pkg-delete-me from all projects and lockfiles and audit for transitive installs
- Rotate all secrets, keys, and credentials stored on affected machines immediately, from a clean computer
- Reimage or rebuild affected hosts; do not assume package removal removed the malware
- Review logs and network traffic for signs of exfiltration or attacker access
- Block the package in npm/CI policy and dependency scanning
Sources
All live incidents on Threat Watch
