@theholocron/holocron-plugin-discord — npm package flagged as malware, full host compromise (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-15
GitHub's advisory database published a malware advisory (GHSA-95pv-hv63-58m8) for the npm package @theholocron/holocron-plugin-discord, affecting version 5.0.0-alpha.436. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched versions exist and no known source code is available, indicating the package itself is malicious rather than a compromised dependency. The package reportedly sees ~41K downloads per month, so any environment that installed the affected version is at risk. Removal of the package alone is not guaranteed to eliminate all malicious software. Organisations should treat this as a credential-theft and host-compromise incident and rotate all secrets from a clean machine.
What to do
- Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a different clean computer
- Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the host
- Audit dependency lockfiles and CI/CD environments for the affected version 5.0.0-alpha.436 and block the package
- Review access logs and monitor for suspicious activity on affected hosts
- Check npm audit / GitHub advisory feeds for other packages from the same maintainer
Sources
All live incidents on Threat Watch
