rex-react-diag-tools-v1 (npm): malicious package compromises any machine where it is installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub's malware advisory database published GHSA-w3r9-3pw6-qg6q on 2026-11-11 flagging the npm package rex-react-diag-tools-v1 as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists, so the package must be treated as malware rather than a vulnerable dependency. Any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software it deployed. Reach appears limited (~292 downloads/month). No CVE is assigned. Remediation requires removal of the package plus full incident response, as no fix will be issued.
What to do
- Rotate all secrets and keys stored on any machine where the package was installed, using a different, clean computer
- Remove rex-react-diag-tools-v1 from all projects and lockfiles and block it in dependency policies
- Rebuild/reimage affected machines; do not assume removal of the package removes the malware
- Audit systems for signs of compromise and review access logs and credentials used on affected hosts
Sources
All live incidents on Threat Watch
