numbors npm package 1.6.1 is malware — full machine compromise; rotate secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub published a malware advisory (GHSA-682c-pwqm-7gxv, CWE-506) for the npm package numbors, flagging version 1.6.1 as embedded malicious code. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched versions exist; the package has no known source code and ~270 downloads/month. Anyone who installed numbors 1.6.1 must treat the machine as attacker-controlled: removal of the package does not guarantee removal of malicious software. Remediation is secret/key rotation from a clean machine and full system rebuild.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a clean computer
- Remove numbors 1.6.1 from all projects and lockfiles and block the package in dependency policy
- Rebuild/reimage affected machines; do not trust the existing environment after removal
- Audit CI/CD runners and developer machines that installed the package for persistence and exfiltration
- Review logs for signs of compromise and notify downstream consumers if distributed in builds
Sources
All live incidents on Threat Watch
