Malware in dsh-vm-tester npm package — full machine compromise; rotate secrets (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-27
GitHub's advisory database published a malware advisory (GHSA-84fw-gj66-p5v3) for the npm package dsh-vm-tester, flagging versions 0.1.2, 0.1.3 and 0.1.4 as containing embedded malicious code (CWE-506). GitHub states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No fixed versions exist and the package has no known source code, so removal is the only option and does not guarantee the machine is clean. Any developer or CI environment that installed the package is affected; secrets and keys on those machines should be treated as stolen.
What to do
- Immediately rotate all secrets, keys, tokens and credentials stored on any machine where dsh-vm-tester was installed, using a clean machine
- Remove dsh-vm-tester from all systems, dependencies and lockfiles
- Rebuild or wipe affected machines; do not assume removal fully cleans them
- Audit for signs of compromise and review CI/CD pipelines that may have run the package
- Block the package in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
