price-scripping-js (npm): malicious package compromises any machine where it is installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub published a malware advisory (GHSA-54cm-q9wq-9442) for the npm package price-scripping-js, classified under CWE-506 Embedded Malicious Code. Every version (= 0) is affected and no patched version exists; the package has been removed from legitimate use and should be treated as fully compromising any machine where it is installed or running. Attackers gain full control of the host, exposing all secrets and keys stored on it. Reach is limited (~324 downloads/month), but any installation is assumed compromised. There is no fix — remediation consists of removing the package, rotating all credentials from a clean machine, and rebuilding/reimaging affected systems, since removal cannot guarantee all malicious software is eliminated.
What to do
- Rotate all secrets, keys, and credentials stored on affected machines immediately, using a different, clean computer
- Remove price-scripping-js from all projects and dependency trees
- Reimage or rebuild affected machines; do not assume removal of the package eliminates the malware
- Audit systems for signs of compromise and review access logs
- Block the package in dependency firewalls/allowlists and scan builds for it
Sources
All live incidents on Threat Watch
