Malicious npm package @user-interface-common/common-styles — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published advisory GHSA-75r2-hqv3-4f7q on 2026-11-03 flagging the npm package @user-interface-common/common-styles as malware (CWE-506, embedded malicious code). All published versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying attackers may have obtained full control, including access to secrets and keys. Anyone who installed the package—directly or as a transitive dependency—is affected. Removal of the package alone is not guaranteed to eliminate the malicious software. No fix is available; remediation is incident response, not upgrading.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine
- Remove the package and rebuild/reimage affected systems; do not assume removal fully cleans the machine
- Audit dependency lockfiles and CI environments for the package and any persistence it may have created
- Block the package name in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
