sickle-wrapper (npm): malicious package fully compromises machines that install it; no patched version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published a malware advisory (GHSA-f64g-9rx5-4jxf) for the npm package sickle-wrapper on 2026-11-06. Every version (= 0) is affected and no patched version exists, as the package is outright malware containing embedded malicious code (CWE-506). Any computer where the package is installed or running should be considered fully compromised, with control potentially handed to an outside entity. All secrets and keys stored on affected machines should be treated as stolen. Removal of the package is advised but may not eliminate all malicious software planted during installation. Any developer or CI environment that installed sickle-wrapper is affected.
What to do
- Rotate all secrets, keys, and credentials stored on machines where sickle-wrapper was installed, using a clean computer
- Remove the package and rebuild/reimage affected machines from trusted images
- Audit install logs and CI pipelines to identify when and where the package was pulled
- Review access logs and network activity for signs of attacker control
- Block sickle-wrapper in dependency policies and lockfiles
Sources
All live incidents on Threat Watch
