npm malware: kafbail — malicious package versions 2.0.12–2.0.14 fully compromise installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub's advisory database published a malware advisory (GHSA-r9ff-73cq-qq8f) for the npm package kafbail, flagging versions 2.0.12, 2.0.13 and 2.0.14 as containing embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No patched versions exist; the advisory recommends removal of the package and immediate rotation of all secrets and keys from a clean machine. Affected users are any developers or CI systems that installed these versions of kafbail from npm. Published and reviewed 2026-11-09.
What to do
- Remove kafbail from all machines and CI environments
- Rotate all secrets, keys, and credentials stored on affected machines, using a clean computer
- Rebuild/reimage compromised machines; do not assume removal of the package removes all malicious software
- Audit npm lockfiles and dependency trees for kafbail versions 2.0.12–2.0.14
- Review logs for signs of exfiltration or unauthorized access
Sources
All live incidents on Threat Watch
