@solarcraft/observix npm package is malware — full machine compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's advisory database has flagged the npm package @solarcraft/observix as malware (CWE-506, embedded malicious code), published 2026-11-10. All versions (= 0) are affected and there are no patched versions — the package itself is the attack. Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. All secrets and keys on affected machines should be treated as stolen. No safe version exists; the only remediation is removal plus full credential rotation and system rebuild.
What to do
- Remove @solarcraft/observix from all machines and CI immediately
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild/reimage affected systems; do not assume removal of the package removes the malware
- Audit npm lockfiles and dependency trees for the package and block it in registries/proxies
- Review logs and network traffic for signs of exfiltration or attacker access
Sources
All live incidents on Threat Watch
