npm malware: @adminide-stack packages — malicious versions fully compromise installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
On 2026-11-04 GitHub published four malware advisories (CWE-506) against npm packages in the @adminide-stack scope: @adminide-stack/utils 0.0.16-130, @adminide-stack/client-redux 0.0.16-18, @adminide-stack/health-api-server 0.0.18-alpha.465, and @adminide-stack/user-activity-browser 0.0.16-129 and 1.1.3-alpha.114. Each advisory states that any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to secrets and keys. No patched versions exist; removal of the package does not guarantee removal of the malicious software. Combined downloads are roughly 1,400/month, so exposure is limited but real for any project depending on these packages.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine
- Remove the affected @adminide-stack packages from all projects and lockfiles and rebuild from trusted sources
- Reimage or fully rebuild compromised machines; do not assume uninstalling the package removes the malware
- Audit install and CI logs to determine when and where affected versions were pulled
- Block the @adminide-stack scope in npm installs and add dependency allowlisting/scanning to prevent reintroduction
Sources
All live incidents on Threat Watch
