Malicious npm packages csec-form-validator, csec-crypto-toolkit (and ccsec- typosquat variants) — full system compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-10-27
On 2026-10-27 GitHub published four malware advisories (GHSA-wh86-6qm8-xgw2, GHSA-v383-2358-576w, GHSA-r889-j2qv-2jv6, GHSA-2732-c6cp-rx5v) covering four npm packages: csec-form-validator, csec-crypto-toolkit, and the near-identical typosquat-style names ccsec-form-validator and ccsec-crypto-toolkit. All versions (= 0) are flagged as embedded malicious code (CWE-506) with no patched versions and no known source code, indicating the packages were published maliciously rather than hijacked. The advisories state any machine with these packages installed or running should be considered fully compromised, implying credential and secret theft with attacker control of the host. The ccsec- variants suggest a coordinated typosquatting campaign against the csec- names. Removal alone is not guaranteed to eliminate the malware.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine
- Remove the packages and rebuild/reimage affected systems; do not assume removal fully cleans the host
- Audit dependency lockfiles, CI/CD environments and developer workstations for any of the four package names and block them in registries/proxies
- Review access and network logs for signs of exfiltration or attacker activity since installation
- Notify incident response and consider the affected hosts untrusted until rebuilt
Sources
All live incidents on Threat Watch
