neat-terminal-visualizer-84721 (npm): malicious package fully compromises machines that install it
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-xp8m-mppr-v6jw, CWE-506 Embedded Malicious Code) for the npm package neat-terminal-visualizer-84721 on 2026-11-10. Every version (= 0) is malicious and there are no patched versions; the package is not a legitimate project with a flaw but outright malware. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity, so removing the package does not guarantee removal of all malicious software. All secrets and keys on affected machines should be treated as stolen. No exploitation details or campaign name are given; the advisory itself confirms the malicious code exists in the published package.
What to do
- Remove neat-terminal-visualizer-84721 from all systems and block it in dependency resolution
- Rotate all secrets, keys, and credentials stored on any machine that installed or ran the package, using a clean machine
- Rebuild/reimage affected machines; do not assume removal of the package removes the malware
- Audit dependency lockfiles and CI environments for the package and review for signs of compromise
Sources
All live incidents on Threat Watch
