Malicious npm packages asavie-ui and @asavie/i18n flagged as malware — full host compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's Advisory Database published malware advisories on 2026-11-13 for two npm packages, asavie-ui (GHSA-wwwv-86vw-pg9w) and @asavie/i18n (GHSA-p2m2-v2jm-mxgq), both classified CWE-506 Embedded Malicious Code. Every version (= 0) is affected and no patched versions exist, so the packages cannot be safely used at all. The advisories state that any computer with these packages installed or running should be considered fully compromised, with control potentially given to an outside entity, and that removing the package does not guarantee removal of all malicious software. @asavie/i18n shows roughly 351 monthly downloads, indicating some real-world exposure. No CVEs are assigned; remediation is removal plus credential rotation and host rebuild.
What to do
- Remove asavie-ui and @asavie/i18n from all projects, lockfiles and CI images and block them in your registry/proxy
- Rotate all secrets, keys, tokens and credentials stored on any machine where the packages were installed, doing so from a clean machine
- Rebuild or reimage affected machines; package removal alone may not remove the malware
- Audit install logs and dependency trees to determine when and where the packages were pulled in
- Monitor for suspicious outbound connections and follow-up compromise indicators on affected hosts
Sources
All live incidents on Threat Watch
