otto-git-cli (npm): malicious package compromises machines and steals secrets — remove and rotate credentials (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub's malware advisory database flagged the npm package otto-git-cli as embedded malicious code (CWE-506), published 2026-11-12. All versions (= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removal of the package does not guarantee removal of all malicious software. Reach appears limited (~156 downloads/month), but any installer is presumed compromised. Remediation is removal of the package plus rotation of all secrets and keys from a clean machine; no fix will be issued since the package is malware.
What to do
- Remove otto-git-cli from all machines and CI environments
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild/reimage affected machines; do not assume removal cleans the system
- Audit for persistence and unauthorized access following compromise
- Block the package in npm dependency policies and lockfiles
Sources
All live incidents on Threat Watch
