Malicious npm package zhg.sql — full host compromise; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub published advisory GHSA-43j9-6qvj-9hgc on 2026-11-09 flagging the npm package zhg.sql as embedded malware (CWE-506). All versions (= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and removal of the package does not guarantee removal of all malicious software. The package sees roughly 22 downloads per month, so reach is limited, but any installation constitutes active compromise. There is no fix; remediation is host-level incident response, not a version upgrade.
What to do
- Treat any machine with zhg.sql installed as fully compromised; isolate it immediately
- Rotate all secrets, keys, and credentials stored on affected machines from a clean computer
- Remove the package and rebuild/reimage affected hosts; do not assume removal cleans the system
- Audit dependency trees and CI/CD environments for zhg.sql and review access logs for signs of attacker control
- Block the package in npm registries and internal mirrors
Sources
All live incidents on Threat Watch
