seolibs-package (npm): malicious package compromises any machine where it is installed; no patched version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub's malware advisory database published GHSA-87pq-f724-32pv on 2026-11-09 flagging the npm package seolibs-package as embedded malicious code (CWE-506). All published versions (= 0) are affected and no patched version exists, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be treated as fully compromised, with attackers potentially having full control and access to secrets and keys. The package sees roughly 67 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software it deployed. There is no fix; remediation is incident response: purge the package, rotate credentials, and rebuild affected machines.
What to do
- Immediately check lockfiles and node_modules for seolibs-package and remove it from all projects and CI
- Treat any machine where it was installed as fully compromised: rotate all secrets, keys, and tokens stored there from a clean machine
- Rebuild/reimage affected machines and CI runners rather than trusting cleanup
- Audit npm install logs and dependency history to determine when the package was introduced and what it may have accessed
- Block the package name in internal registries/proxies to prevent reinstalls
Sources
All live incidents on Threat Watch
