supership-scan npm package is malware — full machine compromise for installers (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database published GHSA-v62j-7p69-5q4q on 2026-11-10 flagging the npm package supership-scan version 1.0.0 as embedded malicious code (CWE-506). Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines should be treated as stolen. The advisory lists no patched versions and none will be provided, so the only remediation is removal plus incident response. Reach is limited (~334 downloads/month), but anyone who installed the package is exposed to credential theft and persistent compromise that uninstalling may not fully remove.
What to do
- Rotate all secrets, keys, tokens and credentials stored on machines where supership-scan was installed, using a clean computer
- Remove supership-scan 1.0.0 from all projects and lockfiles and block the package in dependency policies
- Rebuild/reimage affected machines and hunt for persistence, as removal may not eliminate implanted malware
- Audit CI/CD and developer environments for exposure and review access logs for signs of misuse
- Check dependency trees for the package and add npm provenance/scanning controls
Sources
All live incidents on Threat Watch
