orderly-plugin-liquidity-heatmap (npm): malicious package fully compromises machines that install it (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub's malware advisory database published GHSA-83cj-fp7v-jmfx on 2026-10-26 flagging the npm package orderly-plugin-liquidity-heatmap as embedded malicious code (CWE-506). All published versions (0.0.0-stage through 1.0.6, excluding 1.0.5) are affected and there are no patched versions — the package is malware, not a compromised legitimate library. Any machine with the package installed or running should be considered fully compromised, with secrets and keys exposed to an outside entity. Roughly 1,773 downloads per month indicate limited but real reach. Removal of the package alone does not guarantee remediation, since the attacker may have established persistence. No CVE is assigned; the advisory is reviewed and final with no source code available.
What to do
- Treat any machine with the package installed as fully compromised; rotate all secrets and keys from a clean machine
- Remove the package from all projects, lockfiles, and CI environments
- Audit affected machines for persistence mechanisms and unauthorized access; rebuild from trusted images
- Check npm audit logs and dependency trees for historical installs of the package
- Block the package name in internal registries and dependency firewall policies
Sources
All live incidents on Threat Watch
