Malicious npm package solvit-cli — full machine compromise, no safe versions
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's advisory database published a malware advisory (GHSA-p4j3-63x4-qr3v, CWE-506 Embedded Malicious Code) for the npm package solvit-cli on 2026-11-10. Every published version (0.0.0-stage through 0.5.0) is flagged as malicious, with no patched versions available, meaning the package should be treated as compromised from its first release. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. The package sees roughly 2,027 downloads per month, so some number of developer machines may be affected. No CVE has been assigned and no common name for the malware has been reported.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where solvit-cli was installed, using a different, clean computer
- Remove solvit-cli from all machines and CI environments and audit for persistence mechanisms, as removal may not eliminate all malicious software
- Rebuild or reimage affected machines from trusted images where feasible
- Audit npm lockfiles and dependency trees for solvit-cli and block/flag it in package registries and CI
- Review logs and network traffic for signs of exfiltration or attacker access following installation
Sources
All live incidents on Threat Watch
