paidwithtab npm package 3.0.0 is malware — full machine compromise; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's malware advisory database flagged the npm package paidwithtab version 3.0.0 as embedded malicious code (CWE-506), published 2026-11-03. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists and no source code is known, so the only remediation is removal plus credential rotation. The package had roughly 625 downloads per month, so exposure is limited but real; anyone who installed 3.0.0 should treat all secrets and keys on the affected machine as stolen.
What to do
- Remove paidwithtab from all machines and CI environments immediately
- Rotate all secrets, keys, and credentials stored on affected machines, using a different, clean computer
- Rebuild/reimage affected machines; removal of the package does not guarantee removal of malicious software
- Audit logs and network traffic for signs of exfiltration or attacker access
- Block paidwithtab in dependency allowlists and check lockfiles for the package
Sources
All live incidents on Threat Watch
