Malicious npm packages: harlow-css-mixer, birch-css-utils, postcss-semantic-themes — full system compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub published three malware advisories on 2026-10-26 for npm packages harlow-css-mixer (GHSA-j658-c56g-qxh4, ~150 downloads/month), birch-css-utils (GHSA-p597-2ggw-c82r, ~881 downloads/month), and postcss-semantic-themes (GHSA-fh55-fq5h-h352, ~499 downloads/month). All versions (= 0) are affected, with no patched versions and no known source code. The packages contain embedded malicious code (CWE-506); GitHub warns any computer with the packages installed or running should be considered fully compromised, with full control potentially given to an outside entity. Removal of the package does not guarantee removal of resulting malicious software. All secrets and keys on affected machines should be rotated immediately.
What to do
- Immediately remove harlow-css-mixer, birch-css-utils, and postcss-semantic-themes from all projects and machines
- Rotate all secrets, keys, and credentials stored on machines where these packages were installed, using a clean computer
- Rebuild/reimage affected machines; do not assume package removal removed the malware
- Audit dependency lockfiles and CI environments for these packages and any unexpected post-install scripts
- Block these package names in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
