pdf-html5-page-flip npm package 2.0.2 is malware — full machine compromise; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub published advisory GHSA-j3hx-5mxx-43qh on 2026-11-12 flagging version 2.0.2 of the npm package pdf-html5-page-flip as malware (CWE-506, embedded malicious code). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. There are no patched versions and no known source code; the only remediation is removal of the package plus incident response, since uninstalling cannot guarantee removal of all malicious software. All secrets and keys on affected machines must be rotated from a clean computer. Reach appears limited (39 GitHub stars), but any installation is treated as compromised.
What to do
- Treat any machine with pdf-html5-page-flip 2.0.2 installed as fully compromised; isolate and forensically review it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Remove the package and rebuild affected systems from trusted images where possible
- Audit npm lockfiles and CI/CD environments for the package and block its installation
- Review logs and network traffic for signs of attacker activity following installation
Sources
All live incidents on Threat Watch
