@mobile-platform/magnetic-components (npm): malicious package fully compromises machines that install it
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's advisory database published a malware advisory for the npm package @mobile-platform/magnetic-components on 2026-11-10. All versions (= 0) contain embedded malicious code (CWE-506) and there are no patched versions; the package has been removed from the advisory's remediation path entirely. GitHub states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. The package saw roughly 1,779 downloads per month, so exposure is limited but real. Because the malware may persist beyond package removal, affected machines require forensic cleanup, and all secrets and keys stored on them must be rotated from a clean computer. No fix exists; removal of the package alone is not guaranteed to eliminate the malicious software.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a different, clean computer
- Remove the package and rebuild/reimage affected machines, as removal may not eliminate the malicious software
- Audit build systems and CI runners for the package and review logs for suspicious activity
- Block the package name in dependency management and check lockfiles for transitive installs
Sources
All live incidents on Threat Watch
