Malicious npm package transaction-info-generate-sdk — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
GitHub published a malware advisory (GHSA-23j5-jj88-v9f3) for the npm package transaction-info-generate-sdk, which contains embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity; secrets and keys stored on the machine are at risk. The package sees roughly 482 downloads per month. Removal of the package alone cannot guarantee removal of all malicious software it may have installed. There is no fix; remediation is removal plus credential rotation and system rebuild.
What to do
- Immediately remove transaction-info-generate-sdk from all projects and machines
- Rotate all secrets, keys, and credentials stored on affected machines, using a clean computer
- Rebuild/reimage affected systems; do not assume removal of the package removes the malware
- Audit systems and CI for signs of compromise and unexpected persistence
- Block the package in dependency policies and scan lockfiles for it
Sources
All live incidents on Threat Watch
