Malicious npm package @ts-expect-error/n — full compromise of any machine where installed (none)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub's malware advisory database published GHSA-pc8x-j8xp-chwx on 2026-11-06 flagging the npm package @ts-expect-error/n as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, so removing the package does not guarantee removal of all malicious software. All secrets and keys on affected machines should be rotated. Any developer or CI environment that installed the package is affected; no fixed version is available, so remediation is removal plus host forensics and credential rotation.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from any machine where the package was installed, using a clean machine
- Remove the package from all projects, lockfiles, and CI caches
- Rebuild or wipe affected machines and containers; treat hosts as compromised
- Audit npm dependency trees and lockfiles for the package and similar typosquats
- Review logs and network traffic for signs of attacker access or exfiltration
Sources
All live incidents on Threat Watch
