Malicious npm package react-svg-chunk — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database published GHSA-5mg5-p59w-76r5 on 2026-11-10 flagging the npm package react-svg-chunk as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched versions exist; the package has no known source code repository. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the host. The package sees roughly 704 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software it installed. No CVE is assigned; remediation is incident response, not an upgrade.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where react-svg-chunk was installed, using a clean machine
- Remove react-svg-chunk from all projects and lockfiles and block it in dependency policy
- Rebuild or thoroughly forensically clean affected machines; assume full compromise
- Audit CI/CD runners and developer workstations for the package and signs of compromise
- Check npm audit / advisory feeds and pin reviewed dependencies before future installs
Sources
All live incidents on Threat Watch
