pt-logger-telemetry-eax0x1 (npm): malicious package fully compromises machines that install it
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub's advisory database published a malware advisory for the npm package pt-logger-telemetry-eax0x1 on 2026-11-11. The package is classified as embedded malicious code (CWE-506) with all versions (= 0) affected and no patched versions available. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the host. There is no indication of a legitimate upstream project being compromised; this appears to be a typosquat-style or otherwise malicious package published to npm. Anyone who installed it should treat secrets and keys on the affected machine as stolen and rotate them from a clean machine. Removal of the package alone is not guaranteed to eliminate the malicious software.
What to do
- Immediately remove pt-logger-telemetry-eax0x1 from all systems and CI pipelines
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer
- Rebuild affected machines from trusted images; do not assume package removal fully cleans the system
- Audit dependency lockfiles and npm install logs for the package and check for other unexpected dependencies
- Block the package name in internal registries and enable npm provenance/allowlist controls
Sources
All live incidents on Threat Watch
