npm malware read-react-app-out — full machine compromise on install; rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-wfm4-3cjm-9545) on 2026-11-10 for the npm package read-react-app-out. Every published version (= 0) is malicious and there are no patched versions; the package should not be used under any circumstances. Per the advisory, any computer where the package was installed or executed should be considered fully compromised, with control potentially handed to an outside entity. Attackers can steal secrets and keys and may persist beyond simple package removal. No CVE is assigned; weakness is CWE-506 (embedded malicious code). Removal of the package alone does not guarantee remediation of any malware it deployed.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine
- Remove read-react-app-out from all projects and lockfiles and rebuild affected environments from trusted images
- Audit affected machines for persistence and other malware; reimage if compromise is suspected
- Block the package in npm registries/proxies and CI pipelines
- Review npm install logs and dependency histories for other suspicious packages
Sources
All live incidents on Threat Watch
