@rclaude/darwin-x64 npm package — malicious code, full machine compromise (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
GitHub's advisory database published a malware advisory for the npm package @rclaude/darwin-x64, version 0.2.1, flagged as CWE-506 embedded malicious code. Any machine with the package installed or running should be considered fully compromised, with the attacker potentially having full control; removing the package does not guarantee removal of all malicious software. No patched version exists and no source code repository is known. All users of the package are affected; secrets and keys on affected machines must be treated as stolen. Remediation is incident response, not an upgrade: remove the package, rotate credentials from a clean machine, and rebuild compromised hosts.
What to do
- Treat any machine with @rclaude/darwin-x64 installed as fully compromised
- Rotate all secrets, keys and credentials stored on affected machines, from a clean computer
- Remove the package and rebuild/reimage affected hosts rather than trusting cleanup
- Audit npm dependencies and lockfiles for the package and block it in registries/proxies
- Review logs and network activity for signs of attacker access
Sources
All live incidents on Threat Watch
