Malicious npm package @site-cms/ssr — full system compromise for anyone who installed it (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub's malware advisory database has flagged the npm package @site-cms/ssr as embedded malicious code (CWE-506), published 2026-11-06. All versions (= 0) are affected and no patched version exists; the package has no known source code repository. Any machine with the package installed or running must be considered fully compromised, with control potentially handed to an outside entity. Secrets and keys stored on affected machines are at risk of theft. The advisory instructs removal of the package but warns removal may not eliminate all malicious software planted during installation. Any developer, CI system, or deployment that pulled this package from npm is affected.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where the package was installed, using a clean machine
- Remove @site-cms/ssr from all projects, lockfiles and CI pipelines and audit for persistence mechanisms
- Rebuild/reimage affected machines and CI runners; do not trust them after removal alone
- Audit npm audit logs and dependency trees for other packages from the same publisher
- Review access and network logs for signs of exfiltration or attacker activity
Sources
All live incidents on Threat Watch
