Malware in nulio-connector: npm package nulio-connector v1.1.16 fully compromises installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published advisory GHSA-v25g-rj4q-4q96 on 2026-11-03 flagging npm package nulio-connector version 1.1.16 as malware (CWE-506, embedded malicious code). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated. No patched version exists and no known source code is available, so the only remediation is removal of the package plus incident response on affected hosts. Reach is limited (~1,435 downloads/month), but any installation is treated as active compromise rather than mere exposure.
What to do
- Remove nulio-connector 1.1.16 from all machines and CI/build environments immediately
- Treat affected machines as fully compromised: rotate all secrets, keys, and credentials stored on them from a clean computer
- Audit affected hosts for persistence and additional malicious software; rebuilding from known-good images is safer than cleanup
- Check dependency trees and lockfiles for the package and block it in registries/proxies
Sources
All live incidents on Threat Watch
