@shein-risk/si_verify npm malware — full host compromise for anyone installing the package (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published a malware advisory (GHSA-cj86-h5rm-f7jj, CWE-506 Embedded Malicious Code) for the npm package @shein-risk/siverify, which receives roughly 486 downloads per month. All versions (= 0) are affected and no patched version exists; the package has no known source code. The advisory states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity — implying secret and key theft. Removal of the package does not guarantee removal of all malicious software it deployed. Any developer or CI environment that installed it is affected; there is no fix beyond removal and remediation of the compromised host.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine
- Remove @shein-risk/si_verify from all projects, lockfiles, and CI pipelines and audit for persistence/backdoors on affected hosts
- Check npm lockfiles and dependency trees for the package and block it in dependency firewalls/allowlists
- Rebuild affected machines from trusted images if compromise is suspected
Sources
All live incidents on Threat Watch
