rush-mfa npm package is malware — full compromise of any machine where installed
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's malware advisory database has flagged the npm package rush-mfa as embedded malicious code (CWE-506). Every published version (= 0) is affected and there is no patched version — the package itself is the attack. GitHub warns that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, harvested secrets and keys, and deployed additional persistent malware. The package sees roughly 332 downloads per month, so exposure is limited but real. Removal of the package does not guarantee removal of all malicious software it installed. No fix will be issued; remediation is incident response on affected hosts.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where rush-mfa was installed, using a clean machine
- Audit affected hosts for persistence and additional malware; rebuild/reimage rather than trusting cleanup
- Remove rush-mfa from all projects, lockfiles and CI pipelines; check dependency trees for transitive installs
- Review logs and network traffic from affected machines for attacker activity
- Block/flag rush-mfa in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
