Malicious npm package kvarzo-8f3a2-testmetest — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub published a malware advisory (GHSA-cfr8-88wx-3j9g) for the npm package kvarzo-8f3a2-testmetest on 2026-11-04. All versions (= 0) are classified as embedded malicious code (CWE-506) with no patched version available. Any machine with the package installed or running should be considered fully compromised, as the malware may grant full control to an outside entity. Secrets and keys stored on affected machines are at risk and must be rotated. Removal of the package does not guarantee removal of all malicious software. No CVE is assigned; no fixed version exists, so remediation is removal plus host forensics and credential rotation.
What to do
- Rotate all secrets and keys from a clean machine immediately
- Remove the package and rebuild/reimage affected systems
- Audit dependency trees and lockfiles for the package and block it in registries/proxies
- Review systems for persistence and signs of attacker control
- Check CI/CD and developer machines that may have installed the package
Sources
All live incidents on Threat Watch
