npm malware wave: react-dropzone-v4, ap3-foundations-ui, css-grid-snap-util, @regex33-hackerone/tb-compat — full machine compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
On 2026-10-26 GitHub published four malware advisories (GHSA-cqf2-3c3q-p639, GHSA-g9j6-f655-22p6, GHSA-ww37-mhpw-cm3q, GHSA-vwp8-h222-46p8) flagging npm packages react-dropzone-v4, ap3-foundations-ui, css-grid-snap-util and @regex33-hackerone/tb-compat as containing embedded malicious code (CWE-506). All versions (= 0) are affected and no patched versions exist. The advisories state any machine with these packages installed or running should be considered fully compromised, implying attacker control sufficient to steal secrets and keys and persist beyond package removal. react-dropzone-v4 shows ~596 downloads/month and ap3-foundations-ui ~533/month; the other two have no download figures listed. No common name has been assigned. Remediation is removal of the packages plus credential rotation from a clean machine, as uninstalling may not remove all malicious software.
What to do
- Immediately remove react-dropzone-v4, ap3-foundations-ui, css-grid-snap-util and @regex33-hackerone/tb-compat from all projects, lockfiles and CI caches
- Rotate all secrets, API keys, tokens and credentials stored on any machine where these packages were installed, using a clean computer
- Rebuild affected machines or containers from trusted images; do not assume uninstall removed the malware
- Audit logs and network egress for signs of exfiltration or persistence since installation
- Block these package names in dependency firewalls/allowlists and scan repositories and lockfiles for them
Sources
All live incidents on Threat Watch
