npm malware: @conduitops/logview-archive — malicious package fully compromises installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database has flagged the npm package @conduitops/logview-archive as embedded malicious code (CWE-506). All published versions (= 0) are affected and there are no patched versions — the package itself is the malware. GitHub warns that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets, keys and credentials stored on the machine, and that removal of the package does not guarantee removal of all malicious software it may have deployed. Any developer or CI environment that installed the package is affected. No fix exists; remediation is removal plus full compromise response.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where the package was installed, using a clean machine
- Rebuild or wipe affected machines and CI runners rather than just uninstalling the package
- Audit systems for signs of persistence or attacker access following the compromise
- Remove @conduitops/logview-archive from all projects, lockfiles and dependency caches
- Block the package in npm/CI policy checks and review how it entered the dependency tree
Sources
All live incidents on Threat Watch
