Malicious npm package redeem-onchain-sdk compromises installer machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-xv64-hqwm-65h3) for the npm package redeem-onchain-sdk, flagged as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host, enabling theft of secrets, keys and credentials. Anyone who installed the package is affected; there is no indication of a specific victim organisation. Remediation is removal of the package plus rotation of all secrets and keys from a clean machine, since uninstalling may not remove all malicious software.
What to do
- Rotate all secrets, API keys, SSH keys and credentials stored on any machine where the package was installed, using a different clean computer
- Remove redeem-onchain-sdk from all projects, lockfiles and CI environments
- Rebuild or wipe affected machines and audit for persistence mechanisms
- Audit logs and network egress for signs of exfiltration or attacker access
- Block the package in npm dependency policies and scan repositories for its presence
Sources
All live incidents on Threat Watch
