Malware in monitoring-agent npm package — full system compromise; rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub's malware advisory database published GHSA-fvjv-j94x-c8wm on 2026-10-26 flagging the npm package 'monitoring-agent' as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched versions exist; the package has no known source code. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and removal of the package does not guarantee removal of all malicious software it installed. Reach appears limited (~179 downloads/month), but any installation is treated as active compromise. There is no fix; remediation is removal plus full incident response on affected machines.
What to do
- Immediately rotate all secrets, keys, and credentials stored on any machine where monitoring-agent was installed, using a clean, uncompromised computer
- Remove the package and rebuild/reimage affected machines from trusted images rather than trusting cleanup
- Audit dependency lockfiles, CI caches, and build environments for the package and any persistence it may have installed
- Block monitoring-agent in npm registries, proxies, and dependency firewalls
- Review logs and network traffic for signs of exfiltration or attacker access since installation
Sources
All live incidents on Threat Watch
