Malicious npm packages @velliajs/discord and @velliajs/telegram — full host compromise; rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
On 2026-11-09 GitHub published malware advisories GHSA-rrh4-2mwf-4xw7 and GHSA-9hfr-xx64-hrq4 for the npm packages @velliajs/discord and @velliajs/telegram, flagging them as embedded malicious code (CWE-506) with all versions (= 0) affected and no patched versions. Any machine with these packages installed or running must be considered fully compromised, with attacker access to secrets and keys. The packages masquerade as Discord/Telegram client libraries; @velliajs/discord shows ~302 monthly downloads and a claimed 26K GitHub stars, suggesting typosquat-style social engineering. Removal of the package alone is not guaranteed to remove all malicious software, since full host control may have been ceded. No fix exists; remediation is removal plus credential rotation and host rebuild.
What to do
- Immediately remove @velliajs/discord and @velliajs/telegram from all projects and lockfiles
- Rotate all secrets, API keys, tokens and credentials stored on affected machines, from a clean computer
- Rebuild or reimage affected hosts; do not assume package removal removed the malware
- Audit install/CI logs for the packages and check for persistence mechanisms and exfiltration
- Block the packages in npm registries and dependency firewalls
Sources
All live incidents on Threat Watch
