npm malware: @csp-frontend/dashboard and @csp-frontend/auth packages fully compromise installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub's Advisory Database published malware advisories on 2026-11-12 for two npm packages, @csp-frontend/dashboard (GHSA-4cfc-3234-7449) and @csp-frontend/auth (GHSA-43xc-q6j2-9cw7), both classified as CWE-506 Embedded Malicious Code. All versions (= 0) are affected and no patched versions exist. The advisories state that any computer with these packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, implying secret and key theft. The packages appear to be typosquat-style or hijacked malicious packages rather than legitimate software; @csp-frontend/auth showed roughly 251 downloads per month. Removal of the package does not guarantee removal of all malicious software it may have installed. Organisations should treat any machine that installed them as breached.
What to do
- Immediately rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine
- Remove both packages from all projects, lockfiles and CI caches, and audit for other @csp-frontend/* packages
- Rebuild affected machines or containers from trusted images; do not assume removal of the package removes the malware
- Review npm install logs, CI pipelines and dependency trees for when and where the packages were pulled in
- Block the packages in registry proxies/allowlists and scan for indicators of compromise
Sources
All live incidents on Threat Watch
