Malicious npm package yonzofficial — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub published a malware advisory (GHSA-7hh5-mmvx-fw3m) for the npm package yonzofficial on 2026-11-09. All versions (= 0) are classified as embedded malicious code (CWE-506) with no patched version available. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity; removal of the package does not guarantee removal of the malicious software. The package sees roughly 1,255 downloads per month, so any developer or CI environment that installed it is at risk of credential and secret theft. There is no fix; remediation is removal plus full incident response on affected hosts.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from machines where yonzofficial was installed, using a clean machine
- Isolate and rebuild any computer or CI runner that installed the package; do not trust removal of the package alone
- Audit npm lockfiles and dependency trees for yonzofficial and remove it from all projects
- Review access logs and monitor for suspicious outbound connections or unauthorized activity on affected hosts
- Block the package in internal registries and dependency-scanning tooling
Sources
All live incidents on Threat Watch
