Malicious npm package mre-notificacao-react — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's malware advisory database published GHSA-p5wc-vpqp-p35f on 2026-11-13 flagging the npm package mre-notificacao-react as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. Any developer or CI environment that installed the package is affected; secrets and keys stored on those machines are at risk. There is no fix — the only remediation is removal plus full incident response on affected hosts.
What to do
- Stop using and remove mre-notificacao-react from all projects, lockfiles and CI caches
- Treat every machine that installed or ran it as fully compromised; rebuild hosts from clean images
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Review access logs and cloud/CI activity for signs of attacker use of stolen credentials
- Audit dependencies for other typosquatted or malicious packages from the same source
Sources
All live incidents on Threat Watch
