@mntv-analysis npm packages (@mntv-analysis/ui, ui-components, workspaces-components) — malware, full host compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
On 2026-11-03 GitHub published three malware advisories (GHSA-rrrh-xwrx-pmx6, GHSA-5vh8-xg47-5c3q, GHSA-f672-cw2f-69wr) covering every published version of three npm packages under the @mntv-analysis scope: ui, ui-components, and workspaces-components. The packages contain embedded malicious code (CWE-506) and no safe version exists; any machine where they were installed or executed must be considered fully compromised, with potential theft of secrets, keys, and credentials by an outside attacker. No patched versions are available and no source code is known; removal of the packages does not guarantee removal of attacker persistence. All npm consumers of these packages are affected.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from any machine that installed or ran these packages, using a clean machine
- Remove the packages from all projects and lockfiles and block the @mntv-analysis npm scope
- Rebuild affected machines or at minimum hunt for persistence, as removal does not guarantee a clean system
- Audit CI/CD and developer environments for exposure and review npm audit logs for installs of these packages
Sources
All live incidents on Threat Watch
