monobomber (npm): malicious package compromises any machine where installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub's malware advisory database published GHSA-rxx3-78r3-w9qw on 2026-11-06 flagging the npm package 'monobomber' as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with control potentially ceded to an outside entity, and removal of the package does not guarantee removal of all malicious software. Any developer, CI system, or end user who installed monobomber is affected. There is no fix; remediation consists of removing the package, rotating all secrets and keys from a clean machine, and rebuilding compromised hosts.
What to do
- Treat any machine with monobomber installed as fully compromised; rotate all secrets and keys immediately from a different, clean computer
- Remove the package and rebuild/reimage affected hosts and CI runners rather than trusting cleanup
- Audit dependency locks and install logs for monobomber and block it in registries/proxies
- Review access logs and credentials (npm tokens, cloud keys, SSH keys) for signs of exfiltration
Sources
All live incidents on Threat Watch
