Malicious npm package 'shraps' — full system compromise via embedded malware; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub's malware advisory database published GHSA-qpr9-cqf6-8m73 on 2026-11-11 flagging the npm package 'shraps' as containing embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. The advisory warns that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. The package sees roughly 14 downloads per month, limiting reach, but any installation is treated as a compromise. There is no fix; remediation is limited to removal and incident response.
What to do
- Rotate all secrets and keys stored on any machine where shraps was installed, using a different, clean computer
- Remove the shraps package from all systems and dependencies
- Rebuild/reimage affected machines; do not assume removal of the package removes the malware
- Audit dependency lockfiles and CI environments for shraps usage
- Block/flag shraps in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
