npm malware wave: @flexmr/*, macro-kernel-record-reader +4 more; installed hosts compromised (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-13
On 2026-10-27 GitHub published eight malware advisories covering eight npm package names, and npm replaced each name with a security placeholder that same day. The set is not one campaign: the @flexmr scope and three unscoped names were first published on 2026-10-13 and 2026-10-14, while buttoncontent (2026-04-07) and 6161test1234 (2026-04-21) were published months earlier. For @flexmr/survey-client, an amazon-inspector analysis dated 2026-10-16 describes a sole dependency declared as a bare HTTPS URL, which npm fetches and runs install scripts from at install time, so the code runs on the installing host. No version is safe. Any host that installed one of these packages should be treated as fully compromised: rotate every secret it could reach from a clean machine, rebuild it, and remove the names from lockfiles and caches.
What to do
- Treat every machine (developer, CI runner, production host) that installed any of the eight names as fully compromised; rebuild from a clean image and rotate all secrets it could reach, from a different computer
- Remove the packages from all projects, lockfiles and caches; do not assume removing the package removed the malware
- Search lockfiles and package.json for the eight names, and for dependency specs that are bare https:// URLs rather than registry ranges (the @flexmr/survey-client@10.0.12 pattern, per OSV MAL-2026-17898)
- Block the eight names and the host artifacts.creditslib.com in the internal registry/proxy and dependency scanning
- Review install history and network logs from 2026-10-13 onward for these names, since the malicious versions were public well before the advisories
Sources
All live incidents on Threat Watch
