selectlist-polyfill-lite (npm): malicious package compromises any machine where it is installed; no patched version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database published GHSA-2wg4-r52x-r477 flagging the npm package selectlist-polyfill-lite as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists, meaning the package itself is malware rather than a legitimate library that was backdoored. Any computer where the package is installed or running should be considered fully compromised, with full control potentially handed to an outside entity. The package sees roughly 1,084 downloads per month. GitHub advises removing the package, rotating all secrets and keys stored on affected machines from a different computer, and warns removal may not eliminate all malicious software planted during installation. No fixed version is available; the only safe action is removal and host remediation.
What to do
- Remove selectlist-polyfill-lite from all projects and dependency trees immediately
- Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a clean computer
- Rebuild/reimage affected machines; removal of the package may not remove all malicious software
- Audit dependency lockfiles and CI caches for the package and block it in registries/proxies
- Review logs and network traffic for signs of compromise or exfiltration
Sources
All live incidents on Threat Watch
