@tekmidian/pai: npm package flagged as malware, full host compromise (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-23
GitHub's advisory database published GHSA-xvgg-qjjh-gq34 on 2026-10-23 flagging the npm package @tekmidian/pai as malware (CWE-506, embedded malicious code). Versions 1.0.8, 1.0.9 and 1.0.10 are affected, with no patched versions available — the package itself is malicious, not a compromised release. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying attackers can exfiltrate secrets and keys and maintain control of the host. Removal of the package does not guarantee removal of all malicious software. No fixed version exists; the only remediation is removal plus credential rotation and host rebuild.
What to do
- Remove @tekmidian/pai from all projects and lockfiles and block the package in your dependency allowlists/CI
- Treat affected machines as fully compromised: rotate all secrets, keys, and credentials stored on them, from a clean machine
- Rebuild or reimage affected hosts; do not assume package removal removes the malware
- Audit logs and network traffic for signs of exfiltration or attacker persistence
- Check dependency trees (including transitive dependencies) for other installs of the package
Sources
All live incidents on Threat Watch
