oracle-redis npm package is malware — full host compromise, no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub published a malware advisory (GHSA-h224-x97c-j5g7) for the npm package oracle-redis, flagged as embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists, so any installation should be treated as a full compromise of the host. The advisory warns that attackers may have gained complete control of affected machines, meaning removal of the package does not guarantee removal of all malicious software. All secrets and keys stored on compromised computers should be rotated from a clean machine. Reach appears limited (~261 downloads/month), but any environment that installed the package is assumed compromised.
What to do
- Remove oracle-redis from all projects and lockfiles and block it in dependency policies
- Treat every machine that ran it as fully compromised: rebuild/reimage hosts
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Audit logs and network traffic for signs of attacker access or exfiltration
- Scan for persistence mechanisms and additional malware left behind
Sources
All live incidents on Threat Watch
