Malicious npm package that-fetch compromises all installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub's advisory database published a malware advisory (GHSA-cwjc-3f32-g7cg) for the npm package that-fetch, flagged as CWE-506 embedded malicious code. Every published version (= 0) is affected and no patched version exists, meaning the package appears to have been malicious from the start rather than a hijacked legitimate library. Any machine with the package installed or running should be treated as fully compromised, with potential attacker control and exposure of secrets and keys. The advisory recommends immediate secret rotation from a clean machine and notes removal of the package does not guarantee removal of all malicious software. Published, reviewed and updated 2026-11-04.
What to do
- Treat any machine with that-fetch installed or running as fully compromised
- Rotate all secrets and keys stored on affected machines immediately, from a different clean computer
- Remove the package from all projects and lockfiles
- Rebuild/reimage affected machines; do not assume removal removes all malware
- Audit for persistence and unexpected network activity on affected hosts
Sources
All live incidents on Threat Watch
