npm malware wave: @eforms/forms-api, jshelperdependenceny, @iobandamwer/cache-helper — malicious packages fully compromise hosts
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub published three malware advisories on 2026-10-26 for npm packages @eforms/forms-api (all versions, ~1,339 downloads/month), jshelperdependenceny (versions 0.0.0-stage, 1.0.0, 99.0.0, ~341 downloads/month), and @iobandamwer/cache-helper (versions 0.0.0-stage and 1.0.2–1.1.3). All are classified CWE-506 embedded malicious code with no patched versions; GitHub's standard malware guidance states any machine with the packages installed or running should be considered fully compromised, with attacker access to secrets and keys. No common malware family name is given and no source code is known. Affected users must remove the packages and rotate all credentials from a clean machine, as removal alone may not eliminate the malicious software.
What to do
- Check lockfiles and installed node_modules for the three packages and remove them from all machines and CI runners
- Treat affected machines as fully compromised: rotate all secrets, keys, tokens and credentials stored there, from a clean computer
- Rebuild affected environments from trusted images and audit for persistence beyond the npm package
- Block the package names in npm/registry policy and review dependency install history for exposure
Sources
All live incidents on Threat Watch
