Malware in orderbook-volt-plugin npm package — full machine compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
GitHub published a malware advisory (GHSA-w9pq-6r9f-pj96) for the npm package orderbook-volt-plugin, flagged as CWE-506 embedded malicious code. Versions 0.0.0-stage, 0.0.1 and 0.0.2 are affected, with no patched versions available and no known source code. The advisory states any computer with the package installed or running should be considered fully compromised, implying attackers gained full control and can access secrets, keys and data. All users of the package are affected; the only remediation is removal plus credential rotation from a clean machine, since removal cannot guarantee elimination of all malicious software.
What to do
- Rotate all secrets, keys and credentials stored on any machine where the package was installed, using a different clean computer
- Remove the package and audit affected machines for persistence; consider rebuilding from trusted images
- Check npm lockfiles and CI/CD environments for the package and any versions of it
- Review logs and network traffic for signs of exfiltration or attacker access
Sources
All live incidents on Threat Watch
