Malicious npm package nminer 3.0.0 fully compromises installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub's malware advisory database flagged the npm package nminer version 3.0.0 as embedded malicious code (CWE-506), published 2026-11-04. Any machine with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. The package reportedly sees around 60,000 downloads per month, so exposure could be broad. No patched version exists; the advisory recommends removal, but warns removal cannot guarantee elimination of all malicious software planted during installation. Secrets and keys stored on affected machines should be treated as stolen and rotated from a clean computer. Exploitation is presumed active given the malware classification.
What to do
- Treat any machine with nminer 3.0.0 installed as fully compromised; isolate it
- Rotate all secrets, keys, and credentials stored on affected machines from a clean computer
- Remove the package and rebuild/reimage affected systems rather than trusting cleanup
- Audit for persistence mechanisms and unauthorized access following installation
- Block nminer in dependency resolution and check lockfiles and CI caches for it
Sources
All live incidents on Threat Watch
