Malicious npm package yummy-bolts — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub published a malware advisory (GHSA-v9xg-mgjf-74xm) for the npm package yummy-bolts, flagging versions 1.0.0 through 1.4.0 as containing embedded malicious code (CWE-506). No patched versions exist; the package has no known source code. Any machine where the package was installed or executed should be considered fully compromised, with attacker access to secrets and keys. The package is low-volume (~12 downloads/month, 1 dependent repository), limiting reach, but every installation is treated as a successful compromise. Removal of the package does not guarantee removal of the malicious software it deployed. Remediation requires secret rotation from a clean machine and full incident response on affected hosts.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where yummy-bolts was installed, using a clean computer
- Remove the package and rebuild/reimage affected machines; do not assume removal cleans the system
- Audit dependency trees and lockfiles for yummy-bolts versions 1.0.0–1.4.0 and block the package
- Review CI/CD and developer environments for signs of compromise and unexpected outbound connections
Sources
All live incidents on Threat Watch
