Malicious npm package @postex/common — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub Advisory Database entry GHSA-fq53-vhhm-rqf7, published 2026-11-10, identifies the npm package @postex/common as malware. All versions (= 0) are affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; secrets and keys on affected machines must be rotated. Weakness is classified as CWE-506 (Embedded Malicious Code). No source code repository is known. Any developer or CI environment that installed the package is affected; removal of the package alone does not guarantee removal of malicious software it may have deployed.
What to do
- Rotate all secrets, keys, and credentials stored on machines where @postex/common was installed, using a clean computer
- Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software
- Audit dependency lockfiles and CI pipelines for any use of @postex/common and block the package
- Review logs and network traffic for signs of compromise or exfiltration from affected hosts
Sources
All live incidents on Threat Watch
