Malicious npm package read-react-app-test — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-rf9p-c6g8-r84w) for the npm package read-react-app-test on 2026-11-10. Every version (= 0) is flagged as embedded malicious code (CWE-506) with no patched version available. Per the advisory, any computer where the package is installed or running should be considered fully compromised, with control potentially handed to an outside entity; removal of the package does not guarantee removal of the malicious software. All developers or CI systems that installed the package are affected. There is no fix — the only remediation is removal plus full incident response on affected machines.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine
- Remove the package from all projects, lockfiles, and caches
- Rebuild or wipe affected machines and CI runners; treat them as compromised
- Audit npm dependency trees and lockfiles for the package and block it in registry proxies/allowlists
- Review access logs and network activity from affected hosts for attacker persistence or exfiltration
Sources
All live incidents on Threat Watch
