Malicious npm packages: @dikaaofficial/libsignal-node and @dikaaofficial/eslint-config — embedded malware compromises installers' machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub's advisory database published malware advisories on 2026-11-09 for two npm packages under the @dikaaofficial scope: @dikaaofficial/libsignal-node (GHSA-xpqj-qc3m-679c) and @dikaaofficial/eslint-config (GHSA-cqvc-q8rj-f4pp, ~15 downloads/month). Both are flagged as embedded malicious code (CWE-506) with all versions (= 0) affected and no patched versions. GitHub states any computer with the packages installed or running should be considered fully compromised, implying attackers can gain full control, steal secrets and keys, and persist beyond simple package removal. No source code repository is known. Affected users must rotate all secrets and keys from a clean machine and rebuild compromised systems.
What to do
- Remove both packages from all projects and lockfiles and audit for other @dikaaofficial packages
- Rotate all secrets, API keys, tokens and credentials stored on or accessible from affected machines, using a clean computer
- Reimage or rebuild affected machines; do not assume removal of the package removes the malware
- Review CI/CD and developer environments that may have installed these packages and check for persistence and exfiltration
- Block the @dikaaofficial npm scope in internal registries and dependency firewalls
Sources
All live incidents on Threat Watch
