termchalk (npm): malicious package fully compromises machines that install it; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub's malware advisory database published GHSA-727x-2mvh-8r5c on 2026-11-11 flagging the npm package termchalk as embedded malicious code (CWE-506). All versions (=0) are affected and no patched version exists, so any installation is considered a full compromise with possible outside control of the machine. The advisory instructs that all secrets and keys on affected computers be rotated immediately from a different, clean machine, and warns that removing the package does not guarantee removal of all malicious software it installed. The package sees roughly 314 downloads per month. There is no fix; the only remediation is removal plus full incident response on any machine where it ran.
What to do
- Treat any machine with termchalk installed or run as fully compromised; isolate it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Remove termchalk and rebuild/reimage affected systems; do not assume removal cleans the machine
- Audit for persistence and lateral movement from affected hosts
- Block termchalk in npm registries, lockfiles, and CI pipelines
Sources
All live incidents on Threat Watch
