Malware in dsh-notify-focus npm package — full machine compromise for users of versions 0.5.0, 0.7.0, 0.7.1
Severity: critical · Patch status: no-fix-needed · Since 2026-11-07
GitHub's advisory database published a malware advisory (GHSA-xf64-9h92-4jxq) for the npm package dsh-notify-focus, flagging versions 0.5.0, 0.7.0 and 0.7.1 as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the machine. No patched versions exist and no source code is known; the package (~564 monthly downloads, 1 GitHub star) cannot be safely remediated by upgrade. Users should treat all secrets and keys on affected machines as stolen and rotate them from a clean computer, remove the package, and rebuild/reimage affected systems since removal may not eliminate all malicious software.
What to do
- Rotate all secrets, keys, tokens and credentials stored on machines where dsh-notify-focus was installed, using a different, uncompromised computer
- Remove the package and rebuild or reimage affected machines, as removal may not eliminate all malicious software
- Audit systems and CI environments for the package and review logs for signs of compromise or exfiltration
- Block/avoid installing dsh-notify-focus and pin dependencies to prevent reintroduction
Sources
All live incidents on Threat Watch
