Malicious npm packages atlassian-wallboard-plugin and atlassian-wallboard-plugin1 fully compromise hosts
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
GitHub published malware advisories on 2026-11-02 for two npm packages, atlassian-wallboard-plugin (GHSA-m4gq-5vx2-5x8c) and atlassian-wallboard-plugin1 (GHSA-frgx-cf5w-vxr5), both classified CWE-506 Embedded Malicious Code with critical severity. Every version (= 0) is affected and no patched versions exist. The advisory warns that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. Anyone who installed either package is affected; no in-the-wild exploitation details are given. There is no fix — the packages must be removed and credentials rotated.
What to do
- Remove atlassian-wallboard-plugin and atlassian-wallboard-plugin1 from all systems and dependency trees immediately
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild/reimage compromised hosts; do not assume package removal removed the malware
- Audit CI/CD and lockfiles for historical installs of these packages
- Block both package names in npm registries and internal proxies
Sources
All live incidents on Threat Watch
