npm malware: @nexlayerlabs/postcss-keyframe-utils — malicious package compromises any machine where installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
GitHub published a malware advisory (GHSA-p485-mr88-5q38) for the npm package @nexlayerlabs/postcss-keyframe-utils, marking it as containing embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with potential full control handed to an outside entity, and that removing the package may not remove all malicious software. All developers or CI systems that installed the package should rotate all secrets and keys stored on those machines from a clean computer. The advisory was published, reviewed, and last updated on 2026-10-30.
What to do
- Immediately stop using and remove @nexlayerlabs/postcss-keyframe-utils from all projects and lockfiles
- Treat all machines where the package was installed or run as fully compromised; rebuild them from clean images
- Rotate all secrets, keys, tokens, and credentials stored on affected machines, from a different clean computer
- Audit npm dependencies and CI caches for the package and block its installation
- Review logs and network activity on affected hosts for signs of attacker access or exfiltration
Sources
All live incidents on Threat Watch
