Malicious npm package typo-crypto fully compromises installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory for the npm package typo-crypto, flagging it as embedded malicious code (CWE-506) with no safe version — all versions = 0 are affected and no patched release exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Anyone who installed typo-crypto is affected; the package sees very low usage (~2 downloads/month), limiting reach, but any installation is treated as a successful compromise. Removal of the package alone is not guaranteed to remove the malicious software it installed. No fix is possible; the only remediation is removal plus full incident response.
What to do
- Treat any machine with typo-crypto installed as fully compromised; rotate all secrets and keys from a clean computer immediately
- Remove the package and rebuild/reimage affected machines; do not assume removal clears the malware
- Audit npm dependency trees and lockfiles for typo-crypto and similar typosquatted crypto packages
- Review access logs and network traffic for signs of attacker control since installation
- Block or flag typo-crypto in CI/CD and dependency scanning
Sources
All live incidents on Threat Watch
