Malware in @web3-common/utils npm package — full machine compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's advisory database published a malware advisory (GHSA-253f-9v83-pw5c) for the npm package @web3-common/utils version 1.0.0, classified as CWE-506 embedded malicious code. The advisory states any computer with the package installed or running should be considered fully compromised, with attackers potentially gaining full control, and recommends rotating all secrets and keys from a separate machine. The package has no fixed versions and no known source code, so removal is the only remediation and cannot guarantee the malicious software is gone. Reach appears limited (~34 downloads/month), but any environment that installed it is assumed compromised. No CVE is assigned; the package should be removed and affected machines rebuilt.
What to do
- Remove @web3-common/utils@1.0.0 from all projects and lockfiles
- Rotate all secrets, keys, and credentials stored on machines where it was installed, using a clean computer
- Rebuild or reimage affected machines; do not assume removal fully cleans the system
- Audit npm dependency trees and CI caches for the package and block it in registry policy
Sources
All live incidents on Threat Watch
