Malicious npm package nj-logger — full host compromise; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub published advisory GHSA-6q28-3q3p-8x7c on 2026-11-11 flagging the npm package nj-logger as malware (CWE-506, embedded malicious code). Every published version (=0) is affected and no patched version exists, so any installation is considered a compromise rather than a vulnerability. The advisory states that any computer with the package installed or running should be treated as fully compromised, implying the code grants an outside party full control of the host, enabling theft of secrets, keys and credentials and persistence beyond simple package removal. Reach appears limited (~1540 downloads/month), but any dependent project or developer machine that installed it is exposed. There is no fix; remediation is removal plus host-level incident response.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where nj-logger was installed, using a clean machine
- Treat affected hosts as compromised: rebuild/reimage them and audit for persistence, backdoors and attacker access
- Remove nj-logger from all projects, lockfiles and CI pipelines and block it in dependency policies
- Audit logs and network egress for signs of exfiltration or command-and-control since installation
- Check dependency trees and internal registries for other uses of the package before rebuilding
Sources
All live incidents on Threat Watch
