Malicious npm package @needsaudit/n — full system compromise of any machine where installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published a malware advisory (GHSA-8592-4qmq-q59w) for the npm package @needsaudit/n, flagged as embedded malicious code (CWE-506) with all versions (=0) affected and no patched versions. Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; secrets and keys on affected machines must be treated as stolen. The package sees roughly 256 downloads per month. Removal of the package alone does not guarantee removal of malicious software it may have installed. There is no fix — the only remediation is removal plus full incident response on affected hosts.
What to do
- Immediately remove @needsaudit/n from all projects and machines
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild/reimage affected machines; do not assume package removal removes the malware
- Audit for persistence mechanisms and network connections to attacker infrastructure
- Block the package in npm/CI dependency allowlists and scan dependency trees for it
Sources
All live incidents on Threat Watch
