scdn-jquery npm package is malware — full machine compromise, no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published advisory GHSA-hvpp-rx4h-crg5 on 2026-11-03 flagging the npm package scdn-jquery as malware (CWE-506, embedded malicious code). Every published version (= 0) is affected and no patched version exists, so any installation grants attackers full control of the machine. The advisory states computers running the package should be considered fully compromised and recommends rotating all secrets and keys from a separate, clean machine, since removing the package cannot guarantee removal of all malicious software it deployed. Any developer or CI environment that installed scdn-jquery is affected; there is no safe version to upgrade to — the package must be removed and the environment rebuilt.
What to do
- Treat any machine that installed or ran scdn-jquery as fully compromised; rotate all secrets, keys, and credentials from a clean computer
- Remove the package and rebuild/reimage affected machines and CI runners rather than trusting cleanup
- Audit dependency lockfiles and install history for scdn-jquery across all projects and pipelines
- Review access logs and tokens (npm, GitHub, cloud) for signs of misuse since installation
- Block scdn-jquery in package registries/proxies and alert teams not to install it
Sources
All live incidents on Threat Watch
