stylelint-standard (npm) — malicious package compromises any machine where it is installed (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's malware advisory database flagged the npm package stylelint-standard as embedded malicious code (CWE-506), published 2026-11-13. All versions (= 0) are affected and no patched version exists; the package has been removed from legitimate use and no source code is known. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to secrets and keys. Reach appears limited (~372 downloads/month), but any installation is treated as compromised. There is no fix — remediation consists of removing the package and rotating all credentials from a clean machine.
What to do
- Remove stylelint-standard from all projects and CI immediately
- Treat every machine where it was installed or run as fully compromised
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild affected systems and audit for persistence and lateral movement
- Check dependency lockfiles and CI caches for the package and block it in registries/proxies
Sources
All live incidents on Threat Watch
