Malicious npm package @mamans2973/maman — all versions contain embedded malware, full host compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-10-31
GitHub's malware advisory database flagged the npm package @mamans2973/maman as containing embedded malicious code (CWE-506). Every published version — 1.0.0, 1.0.1, 1.0.2 and 1.0.3 — is affected, with no patched versions available and no known source repository. The package draws roughly 1,060 downloads per month, so some number of developer machines and CI environments are likely infected. GitHub's guidance is that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the host, enabling theft of secrets, keys and credentials. Removal of the package alone cannot guarantee the machine is clean. The advisory was published, reviewed and last updated on 2026-10-31.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where the package was installed, using a clean machine
- Remove @mamans2973/maman from all projects, lockfiles and caches
- Rebuild or wipe affected developer machines and CI runners; do not assume removal of the package cleans the system
- Audit logs and network traffic for signs of exfiltration or attacker access
- Block the package in npm registries/proxies and add dependency scanning to prevent reintroduction
Sources
All live incidents on Threat Watch
