@sideeffects/n npm package is malware — full machine compromise, no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub's malware advisory database has flagged the npm package @sideeffects/n as malicious (GHSA-3r7f-mx9r-h22h, CWE-506 embedded malicious code). Every published version (= 0) is affected and there are no patched versions, so any installation of the package at any version should be treated as a compromise. Per the advisory, any computer where the package was installed or run must be considered fully controlled by an outside entity, meaning attackers may have exfiltrated secrets and keys and deployed additional persistent malware that removal of the package will not eliminate. All developers and CI systems that installed the package are potentially affected. There is no fix; remediation is removal plus credential rotation and host rebuild.
What to do
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a clean computer
- Remove the package and rebuild/reimage affected machines from trusted images; do not trust removal alone
- Audit affected systems for persistence and additional malicious software
- Check npm lockfiles and CI caches for any dependency on @sideeffects/n and block it
Sources
All live incidents on Threat Watch
