prettlog (npm): malicious package fully compromises machines that install it; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub published a malware advisory (GHSA-7m86-chx9-8rr7) for the npm package prettlog on 2026-11-11. Every version (= 0) contains embedded malicious code (CWE-506) and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity, with theft of secrets and keys. Removal of the package does not guarantee removal of all malicious software it installed. Any developer, CI system, or end user who installed prettlog is affected; there is no safe version to upgrade to.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where prettlog was installed, using a clean computer
- Remove prettlog from all projects, lockfiles and CI pipelines and rebuild affected environments from trusted images
- Reimage or rebuild compromised machines; do not assume uninstalling the package removes the malware
- Audit npm dependencies and lockfiles for prettlog and block/review installs of the package
Sources
All live incidents on Threat Watch
