Malware in stelar-sdk npm package — full host compromise, rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub's advisory database published a malware advisory for the npm package stelar-sdk on 2026-11-12. The package, which has all versions affected (= 0) and no patched release, contains embedded malicious code (CWE-506). GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the host. Any secrets or keys stored on affected machines should be treated as stolen. The package sees roughly 238 downloads per month, so exposure is limited but real. There is no fix; removal of the package does not guarantee removal of any malicious software it may have installed.
What to do
- Remove stelar-sdk from all projects and machines immediately
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild/reimage compromised machines; audit for persistence mechanisms
- Audit logs and network traffic for signs of exfiltration or attacker access
- Block the package in dependency management and CI
Sources
All live incidents on Threat Watch
