Malware in dsh-moss-console: npm package dsh-moss-console v3.3.0 fully compromises installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published advisory GHSA-cw2g-cxwh-wqqm on 2026-11-03 flagging npm package dsh-moss-console version 3.3.0 as malware (CWE-506, embedded malicious code). Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated. No patched version exists and no source code is known, so the only remediation is removal of the package plus full incident response, as removal cannot guarantee elimination of all malicious software. Anyone who installed dsh-moss-console 3.3.0 is affected; exploitation is presumed wherever the package was installed.
What to do
- Rotate all secrets, keys, and credentials stored on machines where dsh-moss-console 3.3.0 was installed, using a clean computer
- Isolate and reimage affected machines; do not rely on simply uninstalling the package
- Check install logs and CI/CD systems for the package and audit for follow-on compromise
- Block/remove dsh-moss-console from dependency trees and lockfiles
Sources
All live incidents on Threat Watch
