@s4yhiitestpoc npm malware: malicious scan-* packages fully compromise installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
On 2026-10-26 GitHub published four malware advisories (GHSA-m9p6-4pgh-6gqx, GHSA-96fg-4mp3-2hj5, GHSA-2wfm-2q62-f937, GHSA-vhw8-ph25-jc87) covering npm packages under the @s4yhiitestpoc scope: scan-control-a (~221 downloads/month), scan-https-d (~554), scan-echo-b (~253) and scan-dns-c (~257). All versions (= 0) are flagged as embedded malicious code (CWE-506) with no patched versions and no known source code. GitHub's standard malware guidance states any machine with these packages installed or running should be considered fully compromised, implying attacker control and exposure of stored secrets and keys. There is no fix; removal of the package does not guarantee removal of malicious software. Anyone who installed any version of these packages is affected.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine
- Isolate and rebuild affected machines from trusted images; do not rely on uninstalling the package to remove the malware
- Audit dependency lockfiles and CI/CD environments for any @s4yhiitestpoc packages and remove them from all projects
- Review access logs, network egress and cloud accounts for signs of compromise since installation
- Block the @s4yhiitestpoc scope in npm installs and enable dependency malware scanning
Sources
All live incidents on Threat Watch
