Malicious npm package @noinheritdoc/n — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub's Advisory Database published GHSA-8qcq-2278-9c4c on 2026-11-06 flagging the npm package @noinheritdoc/n as malware (CWE-506, embedded malicious code). All versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. Any developer or CI environment that installed the package is affected. There is no fix — remediation is removal, secret rotation from a clean machine, and system rebuild.
What to do
- Immediately stop using/remove @noinheritdoc/n from all projects and CI pipelines
- Rotate all secrets, keys, and credentials stored on affected machines, from a different clean computer
- Rebuild or reimage affected machines; do not assume package removal removes the malware
- Audit systems for persistence mechanisms and unauthorized access
- Block the package in npm registries and dependency scanning
Sources
All live incidents on Threat Watch
