Malicious npm package txnforge — full host compromise; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published advisory GHSA-qjw2-5743-xhp4 on 2026-11-03 flagging the npm package txnforge as malware (CWE-506, embedded malicious code). Every published version (= 0) is affected and there are no patched versions, so any installation should be treated as a full compromise of the host machine with possible attacker control and exfiltration of secrets and keys. The advisory does not name a distribution vector, campaign, or specific victim organisations. Remediation requires removing the package, rotating all secrets and keys from a clean machine, and rebuilding affected hosts, since removal alone cannot guarantee the malware is eradicated.
What to do
- Treat any machine where txnforge was installed or run as fully compromised; isolate it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer
- Remove txnforge from all projects and lockfiles and audit for other signs of persistence
- Rebuild/reimage affected hosts rather than trusting cleanup
- Audit npm dependencies and CI caches for txnforge and block its installation
Sources
All live incidents on Threat Watch
