Malicious npm package monkey-tags-ip — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's advisory database published a malware advisory (GHSA-97j9-4wmq-rgfv) for the npm package monkey-tags-ip on 2026-11-03. The package contains embedded malicious code (CWE-506) and every published version (= 0) is affected, with no patched version available. GitHub warns that any computer with the package installed or running should be considered fully compromised, as full control may have been handed to an outside entity; removal of the package does not guarantee removal of all malicious software. Developers and CI systems that installed the package should treat stored secrets and keys as stolen. No fix exists; remediation is removal plus credential rotation and system rebuild.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer
- Remove monkey-tags-ip from all projects, lockfiles, and caches
- Rebuild or reimage affected machines; do not assume removal of the package cleans the system
- Audit logs and network traffic for signs of attacker access or exfiltration
- Block the package in npm/CI dependency allowlists and scan dependency trees for it
Sources
All live incidents on Threat Watch
