Malware in futrou npm package — full machine compromise for users of version 2.0.40
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database flagged the npm package futrou, version 2.0.40, as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists; the package has no known source code repository. The package sees roughly 1,270 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software installed as a result. Users should treat all secrets and keys on affected machines as stolen and rotate them from a clean machine.
What to do
- Remove futrou 2.0.40 from all systems and rebuild affected machines from trusted images
- Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a different clean computer
- Audit systems for persistence mechanisms and other malicious software left behind after removal
- Check dependency trees and CI/CD environments for futrou usage and block the package
Sources
All live incidents on Threat Watch
