@seggy116/next-diff: npm package contains malware, full host compromise (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-22
GitHub's advisory database published GHSA-fv2r-964m-pc2m on 2026-10-22 flagging version 0.3.0 of the npm package @seggy116/next-diff as malware (CWE-506, embedded malicious code). The advisory warns that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines should be rotated. No patched version exists and no known source code is available, so remediation is removal plus incident response rather than an upgrade. Anyone who installed the package is affected; exploitation is presumed wherever it was installed.
What to do
- Remove @seggy116/next-diff 0.3.0 from all systems and dependency trees
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild/reimage affected machines; do not assume removal of the package removes the malware
- Audit for persistence mechanisms and lateral movement from affected hosts
- Block the package in dependency management and CI to prevent reinstalls
Sources
All live incidents on Threat Watch
