tchain-api (npm): malicious package versions 1.2.2–1.2.5 fully compromise installed machines; no patched versions
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database published GHSA-353c-q3qh-4wwc on 2026-11-10 flagging npm package tchain-api versions 1.2.2 through 1.2.5 as containing embedded malicious code (CWE-506). Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated from a clean computer. There are no patched versions and no known source code repository; the advisory states removal of the package cannot guarantee removal of all malicious software it installed. With roughly 229 downloads per month, exposure is limited but real, and the package should be treated as actively malicious rather than a vulnerable dependency.
What to do
- Remove tchain-api 1.2.2–1.2.5 from all machines and CI environments immediately
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer
- Rebuild/reimage affected systems; do not assume package removal removes the malware
- Audit for persistence, unauthorized access, and lateral movement from affected hosts
- Block the package in dependency policies and check lockfiles for transitive installs
Sources
All live incidents on Threat Watch
