Malicious npm package winks.tunnelsql — full compromise of installed machines; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub Advisory Database published GHSA-4rrg-994x-267f on 2026-11-09 flagging the npm package winks.tunnelsql as embedded malware (CWE-506). All versions (= 0) are affected and no patched version exists; the package has been removed from distribution guidance entirely. Any machine with the package installed or running must be considered fully compromised, with attacker control implying potential theft of secrets, keys, and credentials and persistence beyond simple package removal. Reach appears limited (~30 downloads/month), but every installation is treated as a successful compromise. There is no fix; remediation is removal plus full secret rotation and host rebuild from a clean machine.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a different, clean computer
- Remove the winks.tunnelsql package from all projects and lockfiles
- Rebuild/reimage affected hosts; do not assume removal of the package removes the malware
- Audit systems for persistence mechanisms and signs of attacker activity
- Block the package in dependency firewalls/CI to prevent reintroduction
Sources
All live incidents on Threat Watch
