@s4yhiitestpoc/r2-https-b npm package is malware — full machine compromise, no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub's malware advisory database flagged the npm package @s4yhiitestpoc/r2-https-b as embedded malicious code (CWE-506, GHSA-h99w-8693-g33v), published 2026-10-26. All versions (= 0) are affected and there are no patched versions — the package itself is the attack. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to secrets and keys. Anyone who installed this package from npm is affected. Removal alone is not guaranteed to eliminate malicious software it may have dropped. No fix exists; remediation is host-level incident response and credential rotation.
What to do
- Treat any machine where the package was installed or run as fully compromised; isolate and forensically review it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Remove the package and investigate for persistence mechanisms or additional dropped malware
- Rebuild affected systems from trusted images rather than cleaning in place
- Block/audit for the package in dependency lockfiles and CI caches
Sources
All live incidents on Threat Watch
