npm malware wave: kampodine, modelsdesk, tailwind-animationfound, @cherrydotfun/miniapp-sdk — malicious packages fully compromise hosts
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
On 2026-11-06 GitHub published four malware advisories for npm packages: kampodine 0.8.0, modelsdesk 0.4.2 (~7 downloads/month), tailwind-animationfound (all versions), and @cherrydotfun/miniapp-sdk 0.1.22 (~1,576 downloads/month, 2 GitHub stars). Each is classified CWE-506 Embedded Malicious Code with no patched versions; GitHub states any computer with the package installed or running should be considered fully compromised, implying attacker control and potential secret/key theft. Affected users are any developer or CI environment that installed these versions. Removal alone is not guaranteed to eliminate implanted malware. No CVEs or common malware names are given; remediation is uninstall plus credential rotation and host rebuild.
What to do
- Immediately uninstall the affected packages (kampodine 0.8.0, modelsdesk 0.4.2, tailwind-animationfound any version, @cherrydotfun/miniapp-sdk 0.1.22) and block them in dependency policies
- Rotate all secrets, API keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild/reimage affected hosts and CI runners; do not assume removal of the package removes the malware
- Audit dependency lockfiles and install logs for these packages and review for signs of compromise
- Add these package names to deny-lists and enable npm/GitHub malware advisory scanning in CI
Sources
All live incidents on Threat Watch
