Malicious npm package 'solidty' (typo of Solidity) — full machine compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub published advisory GHSA-27m9-96qf-23mq on 2026-11-12 flagging the npm package 'solidty' — a likely typo-squat of 'solidity' — as malware (CWE-506, embedded malicious code). All versions (= 0) are affected and there are no patched versions; the package should not be used at all. The advisory states any computer with the package installed or running should be considered fully compromised, implying attackers may have obtained full control, including access to secrets and keys. The package sees roughly 233 downloads per month. Removal of the package does not guarantee removal of malicious software already deployed. No CVE is assigned; no fix exists beyond removing the package and rebuilding affected systems.
What to do
- Rotate all secrets, keys, and credentials stored on machines where 'solidty' was installed, using a clean computer
- Remove the 'solidty' package and rebuild/reimage affected machines, as removal may not eliminate all malicious software
- Audit npm lockfiles and dependency trees for 'solidty' and block it in registries/CI
- Check for signs of compromise and investigate persistence mechanisms on affected hosts
Sources
All live incidents on Threat Watch
