Malware in @needsaudit/nexport npm package — full host compromise, rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published a malware advisory (GHSA-v24v-jw84-cp3h) for the npm package @needsaudit/nexport, flagged as embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists, so the package cannot be safely used at any version. The advisory states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of the malicious software. All secrets and keys on affected machines should be treated as stolen. Reach appears limited (~267 downloads/month), but any installation warrants full incident response including secret rotation and host rebuild.
What to do
- Treat any machine with @needsaudit/nexport installed as fully compromised; rotate all secrets and keys from a clean machine immediately
- Remove the package and rebuild/reimage affected hosts rather than trusting cleanup
- Audit dependency trees and CI/CD for the package and block it in registries/proxies
- Review logs for signs of exfiltration or follow-on attacker activity
Sources
All live incidents on Threat Watch
