Malicious npm package web-pixels-manager — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's malware advisory database published GHSA-v6gx-6p2r-f6pp on 2026-11-03 flagging the npm package web-pixels-manager as embedded malicious code (CWE-506). All published versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, so removing the package does not guarantee removal of all malicious software. Any developer or CI environment that installed the package is affected; secrets and keys stored on those machines are at risk. There is no fix — remediation is removal plus credential rotation from a clean machine.
What to do
- Treat any machine where web-pixels-manager was installed or run as fully compromised
- Rotate all secrets, keys, and credentials stored on affected machines immediately, from a different clean computer
- Remove the package from projects, lockfiles, and CI pipelines and audit for persistence mechanisms
- Rebuild affected systems from clean images where feasible
- Review npm install logs and dependency trees for other typosquat or malicious packages
Sources
All live incidents on Threat Watch
