Malicious npm packages @secauditb20y/sec-test-r3b, @secaudita10x/sec-test-a1, @secauditb20y/sec-test-b1 flagged as malware
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub's advisory database published three malware advisories on 2026-11-04 covering npm packages @secauditb20y/sec-test-r3b (GHSA-h95w-3ffr-98m2), @secaudita10x/sec-test-a1 (GHSA-pgq7-5652-37p2) and @secauditb20y/sec-test-b1 (GHSA-4rp3-383p-p8qj). All versions (= 0) are affected, with no patched versions available, and each carries CWE-506 (Embedded Malicious Code). GitHub's standard malware guidance states any machine with these packages installed or running should be considered fully compromised, with attacker access to secrets and keys. The package names suggest deliberately planted test/malicious packages rather than typosquats of real libraries. Any developer or CI system that installed them is at risk of credential theft and persistent compromise; removal of the package alone does not guarantee remediation.
What to do
- Immediately remove the packages from all projects, lockfiles and CI caches
- Rotate all secrets, keys and tokens stored on or accessible from affected machines, using a clean machine
- Rebuild affected machines or containers from trusted images; do not assume removal fully cleans the host
- Audit npm install logs, CI pipelines and lockfiles for any occurrence of these package names
- Block the @secauditb20y and @secaudita10x scopes in registry proxies and dependency firewalls
Sources
All live incidents on Threat Watch
