Malicious npm package npm-builderio-qwik-poc fully compromises installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub published a malware advisory (GHSA-923c-wff6-2p7q) for the npm package npm-builderio-qwik-poc, classified under CWE-506 Embedded Malicious Code. All published versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Anyone who installed the package—directly or as a dependency—should treat secrets and keys on the machine as stolen. Removal of the package does not guarantee removal of all malicious software. The package appears to impersonate Builder.io's Qwik framework. No common name has been assigned to the campaign.
What to do
- Rotate all secrets, API keys, SSH keys, and credentials stored on any machine where the package was installed, using a clean machine
- Rebuild or wipe affected machines rather than just uninstalling the package
- Audit dependency trees and lockfiles for npm-builderio-qwik-poc and remove it
- Review access logs and monitor for suspicious activity from affected systems
- Scan for persistence mechanisms and additional malware left by the package
Sources
All live incidents on Threat Watch
