mocha-ui-themes (npm): malicious package compromises any machine where it is installed
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub published a malware advisory (GHSA-8wh7-jcx5-hv37) for the npm package mocha-ui-themes, flagged as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software it deployed. Any developer, CI system, or end user who installed the package is affected. There is no fix — remediation is removal plus full incident response including secret rotation and system rebuild.
What to do
- Remove mocha-ui-themes from all projects, lockfiles, and CI pipelines
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild or reimage affected machines; do not assume removal of the package clears the compromise
- Audit npm dependencies for the package and block/reinstall from trusted sources
- Review logs and network activity for signs of attacker access following installation
Sources
All live incidents on Threat Watch
