@rclaude/win32-x64 npm package is malware — full machine compromise for installers of version 0.2.1
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's advisory database published GHSA-w584-99h6-6g9r on 2026-11-10 flagging npm package @rclaude/win32-x64 version 0.2.1 as malware (CWE-506, embedded malicious code). The advisory states any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated. No patched versions exist and no known source code is listed, so the package cannot be safely used at any version. Anyone who installed 0.2.1 — likely developers on Windows x64 pulling a Claude-related native binary — is affected. Removal of the package does not guarantee removal of the malicious software.
What to do
- Treat any machine with @rclaude/win32-x64@0.2.1 installed as fully compromised; isolate it
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Remove the package and rebuild/reimage affected systems; do not assume removal fully cleans the machine
- Audit npm lockfiles and CI caches for the package and block it in dependency firewalls/allowlists
- Review logs and network traffic for signs of attacker access following installation
Sources
All live incidents on Threat Watch
