@tomhundley npm packages (mypackagetest, condux, sparkdash, grafene): malware — full machine compromise; rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
On 2026-11-11 GitHub published four malware advisories (GHSA-gfh2-8j8w-933m, GHSA-jgmp-2vff-26jw, GHSA-gpvw-6mq7-2h5w, GHSA-65fw-m4q2-8ffh) covering every published version of four npm packages under the @tomhundley scope: mypackagetest, condux, sparkdash and grafene. All are classified CWE-506 embedded malicious code with no patched versions; GitHub states any machine with the packages installed or running should be considered fully compromised, implying attacker control of the host and access to stored secrets and keys. Reach appears small (grafene ~18 downloads/month), but any consumer is affected. No fix exists — removal of the packages does not guarantee removal of the malicious software.
What to do
- Immediately remove all @tomhundley/* packages from every machine and CI environment
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild/reimage compromised hosts; audit for persistence and follow-on malware
- Audit dependency lockfiles and block the @tomhundley npm scope
- Review npm/CI logs for signs of exfiltration or unauthorized access
Sources
All live incidents on Threat Watch
