synapse-hub (npm): malicious package 3.1.0 fully compromises machines that install it (GHSA-q7g7-jwp5-cvgh)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-05
GitHub's advisory database published a malware advisory (GHSA-q7g7-jwp5-cvgh, CWE-506 Embedded Malicious Code) for the npm package synapse-hub, version 3.1.0. The advisory states that any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity. No patched versions exist; the package should not be used at all. All secrets and keys stored on affected machines should be rotated immediately from a different, clean computer. Removing the package does not guarantee removal of all malicious software it may have installed. Any developer or CI environment that installed synapse-hub 3.1.0 is affected.
What to do
- Treat any machine that installed or ran synapse-hub 3.1.0 as fully compromised; rebuild from clean images
- Rotate all secrets, keys, and credentials stored on affected machines immediately, from a different computer
- Remove the package and audit for persistence mechanisms and additional malware it may have dropped
- Review logs and network traffic for signs of exfiltration or attacker access
- Block synapse-hub in dependency allowlists and scan repositories and lockfiles for it
Sources
All live incidents on Threat Watch
