Malicious npm package noon-contracts — full system compromise on install; no safe version exists (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub published advisory GHSA-qj9j-8fcr-pjq2 on 2026-11-04 flagging the npm package noon-contracts as malware (CWE-506, embedded malicious code). All versions (= 0) are affected and no patched version exists; the package has been removed from distribution guidance entirely. Any machine with the package installed or running must be considered fully compromised, with attacker control of the host and access to secrets and keys. Roughly 303 downloads per month indicate limited but real exposure. Because full control may have been handed to an outside entity, uninstalling the package cannot be assumed to remove all malicious software. Remediation requires secret rotation from a clean machine and forensic rebuild of affected hosts.
What to do
- Immediately rotate all secrets, keys, and credentials stored on or accessible from machines where noon-contracts was installed, using a clean, uncompromised computer
- Isolate and rebuild/reimage affected machines from trusted media; do not assume uninstalling the package removes the malware
- Audit npm lockfiles and CI/CD environments for noon-contracts and any unexpected dependencies
- Review logs and network traffic for signs of attacker access or exfiltration following installation
Sources
All live incidents on Threat Watch
