Malware in yzx-npm npm package — versions 1.0.0 and 1.0.1 fully compromise installed machines; no clean version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub's malware advisory database (GHSA-2mqp-mxm3-j2fh, published 2026-11-04) flags the npm package yzx-npm as containing embedded malicious code (CWE-506). Versions 1.0.0 and 1.0.1 are affected and there are no patched versions — the package should not be used at all. GitHub states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets and keys stored on the machine. Removal of the package does not guarantee removal of all malicious software it deployed. All developers or CI systems that installed yzx-npm are affected; no fixed release is available, so remediation is incident response rather than an upgrade.
What to do
- Treat any machine that installed or ran yzx-npm as fully compromised; isolate and rebuild it
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Remove the yzx-npm package from all projects, lockfiles and CI pipelines and audit for persistence mechanisms it may have installed
- Check npm audit logs and dependency trees for other machines or environments that pulled the package
- Block yzx-npm in internal registries and dependency firewall policies
Sources
All live incidents on Threat Watch
