Malicious npm packages: path-stream-utils-testmetest and @iobandamwer/native-helper — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub's advisory database published two malware advisories on 2026-10-26 flagging the npm packages path-stream-utils-testmetest (GHSA-7pvr-f92m-6fwg) and @iobandamwer/native-helper (GHSA-g457-v22r-g8j3) as embedded malicious code (CWE-506). Every version (= 0) is affected and no patched versions exist, so any installation is unsafe. GitHub's guidance states that any computer with these packages installed or running should be considered fully compromised, with attacker control potentially granted to an outside entity; secrets and keys on affected machines must be rotated from a clean computer, and removing the package does not guarantee removal of all malicious software. No common name, CVE, or in-the-wild exploitation details are given.
What to do
- Check dependency trees and lockfiles for path-stream-utils-testmetest and @iobandamwer/native-helper; quarantine and rebuild any machine where they were installed
- Rotate all secrets, tokens, SSH keys, and credentials stored on affected machines, using a clean computer
- Remove the packages and reimage/rebuild affected systems rather than trusting cleanup
- Audit npm install logs and CI runners for exposure; block the package names in registry proxies and dependency firewalls
- Review for signs of compromise (unusual processes, outbound connections, credential use) on affected hosts
Sources
All live incidents on Threat Watch
