Malicious npm package xapi-lib — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published a malware advisory (GHSA-wm6w-9vgq-gw26, CWE-506 Embedded Malicious Code) for the npm package xapi-lib on 2026-11-03. Every published version (= 0) is affected and no patched version exists; the package is considered malware rather than a vulnerable library. Any computer where the package is installed or running should be treated as fully compromised, with attacker control implying potential theft of secrets, keys and credentials and persistence beyond simple package removal. No exploitation details, campaign name, or attribution are given. Organisations with the package in their dependency tree should treat associated hosts as breached, rotate all credentials from a clean machine, and remove the package and any persistence it established.
What to do
- Treat any machine with xapi-lib installed or running as fully compromised
- Rotate all secrets, keys and credentials stored on affected machines, from a clean computer
- Remove the package and hunt for persistence or additional malicious software it may have installed
- Audit dependency trees and CI/CD for xapi-lib and block/rebuild from clean images
Sources
All live incidents on Threat Watch
