Malicious npm packages m98th, m98bet, 789bet, m98vip — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
GitHub's advisory database published four critical malware advisories on 2026-10-29 for npm packages m98th, m98bet, 789bet, and m98vip, flagged under CWE-506 (Embedded Malicious Code). Every version of each package is affected and no patched versions exist, so the packages cannot be safely used at all. The advisories state that any computer with these packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. The package names suggest a gambling/brand-impersonation typosquat campaign. Reach appears low (m98vip shows ~17 downloads/month), but any developer or CI machine that installed them is at risk of secret and key theft. No fix exists; remediation is removal plus credential rotation and system rebuild.
What to do
- Remove m98th, m98bet, 789bet and m98vip from all machines, CI runners and lockfiles immediately
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild/reimage affected machines; removal of the package does not guarantee malware removal
- Audit install logs and dependency trees for these packages and any related suspicious packages
- Block these package names in npm registry proxies/internal mirrors and alert developers
Sources
All live incidents on Threat Watch
