Malware in tabby-fknat npm package — full machine compromise (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
GitHub's malware advisory database flagged the npm package tabby-fknat (version 0.1.2) as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists and no source code is known; the package should be removed entirely. All secrets and keys on affected machines must be rotated from a clean computer, since removal of the package cannot be guaranteed to remove all malicious software it installed. Published and reviewed 2026-10-30.
What to do
- Remove tabby-fknat from all machines and CI environments
- Rotate all secrets, keys, and credentials stored on affected machines, using a clean computer
- Reimage or rebuild affected machines; do not assume removal cleans the system
- Audit for persistence mechanisms and lateral movement from affected hosts
- Block the package in dependency policies and registries
Sources
All live incidents on Threat Watch
