Malware in self-certificate npm package — full compromise of installed machines; rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub published a malware advisory (GHSA-6p47-hr8r-4wq6) for the npm package self-certificate, classified under CWE-506 Embedded Malicious Code. Every version (= 0) is affected and no patched version exists; the package has been removed from legitimate use and should be treated as malicious at any version. Any machine with the package installed or running must be considered fully compromised, with control potentially handed to an outside entity. Roughly 151 downloads per month indicate limited but real reach. Removal of the package alone is not guaranteed to eliminate the malicious software it installed. There is no fix; remediation is host-level incident response and credential rotation.
What to do
- Treat any machine with self-certificate installed as fully compromised; isolate and rebuild from clean images
- Rotate all secrets, keys, and credentials stored on affected machines, using a different, clean computer
- Remove the package and hunt for persistence or additional malware it may have deployed
- Audit dependency trees and CI caches for self-certificate and block its installation
Sources
All live incidents on Threat Watch
