Malicious npm package react-native-drago-callkit — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
GitHub's malware advisory database published GHSA-jp74-4rg3-7ppj on 2026-10-29 flagging the npm package react-native-drago-callkit as containing embedded malicious code (CWE-506). Affected versions are 0.0.0-stage, 1.0.0, 1.0.1, 1.0.2, 1.0.15 and 1.0.16, with no patched versions available. The advisory states that any computer with the package installed or running should be considered fully compromised, implying the code grants outside parties full control of the machine. All secrets and keys on affected machines should be treated as stolen. No source code repository is known for the package. Any developer or CI environment that installed the package is affected; removal of the package alone cannot be assumed to remove the malicious software.
What to do
- Immediately remove react-native-drago-callkit from all projects, lockfiles and CI pipelines
- Treat every machine that installed or ran the package as fully compromised; rotate all secrets, keys and credentials from a clean machine
- Rebuild affected machines and audit for persistence mechanisms and residual malware
- Audit npm dependency trees and lockfiles for the package and block it in registry/proxy allowlists
- Review access logs and network egress for signs of exfiltration since installation
Sources
All live incidents on Threat Watch
