text-regexer (npm) 4.3.0 is malware — full machine compromise, no patched version
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database published GHSA-p4p5-f7j2-g67x on 2026-11-10 flagging version 4.3.0 of the npm package text-regexer as embedded malicious code (CWE-506). Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No patched version exists; the advisory recommends removal of the package, though removal cannot guarantee elimination of all malicious software it may have installed. All secrets and keys stored on affected machines should be rotated immediately from a different, clean computer. Organisations using this package should treat affected hosts as compromised and perform forensic cleanup or rebuild.
What to do
- Remove text-regexer 4.3.0 from all projects and lockfiles immediately
- Rotate all secrets, keys, and credentials stored on machines where the package was installed, from a clean computer
- Rebuild or forensically clean affected machines; removal of the package does not guarantee removal of malware
- Audit npm dependencies and CI environments for the package and block it going forward
Sources
All live incidents on Threat Watch
