Malware in @hello.nrfcloud.com/proto-map npm package — full machine compromise; rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
The GitHub Advisory Database published a malware advisory (GHSA-mc5j-m8rr-4m27, CWE-506 Embedded Malicious Code) for the npm package @hello.nrfcloud.com/proto-map, versions 18.0.0 and 18.1.0. GitHub classifies the package as fully malicious with no patched versions available, and states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. Roughly 2,616 downloads per month are affected. Removal of the package is advised but cannot be guaranteed to remove all malicious software. No fix exists; remediation is removal plus credential rotation from a clean machine.
What to do
- Immediately remove @hello.nrfcloud.com/proto-map versions 18.0.0 and 18.1.0 from all projects and lockfiles
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean computer
- Rebuild affected systems from trusted images; do not assume removal fully cleans the machine
- Audit npm dependency trees and CI caches for the package and block it in dependency policy
- Review logs for signs of exfiltration or unauthorized access
Sources
All live incidents on Threat Watch
