Malicious npm package test1817 — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-05
GitHub published a malware advisory (GHSA-jfvg-hq3f-9865) for the npm package test1817 on 2026-11-05. All versions (= 0) are affected and no patched version exists. The package contains embedded malicious code (CWE-506) that gives an outside entity full control of any computer where it is installed or running, meaning secrets and keys on affected machines should be considered stolen. Removal of the package does not guarantee removal of the malicious software it deployed. Any developer or CI environment that installed test1817 should be treated as fully compromised.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where test1817 was installed, using a clean computer
- Remove test1817 from all projects, lockfiles, and CI pipelines and audit for persistence mechanisms
- Rebuild or wipe affected machines and CI runners from trusted images
- Review npm audit logs and dependency history for when test1817 was introduced
- Block the package name in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
