node-zserial npm package 1.0.42 is malware — full machine compromise, no patched version
Severity: critical · Patch status: no-fix-needed · Since 2026-11-15
GitHub's advisory database published GHSA-2p2h-g9qq-v2wx on 2026-11-15 flagging version 1.0.42 of the npm package node-zserial as malware (CWE-506, embedded malicious code). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and no patched versions exist. The package sees roughly 249 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software it installed. Anyone who installed node-zserial 1.0.42 should treat all secrets and keys on affected machines as stolen and rotate them from a clean machine.
What to do
- Treat any machine with node-zserial 1.0.42 installed as fully compromised; isolate it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Remove the package and rebuild/reimage affected systems; do not assume removal fully cleans the machine
- Audit dependency lockfiles and CI pipelines for node-zserial and block/reject the package
- Review logs and network traffic for signs of attacker access following installation
Sources
All live incidents on Threat Watch
