trgrip (npm): malicious package compromises any machine where it is installed; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published advisory GHSA-fw89-fphx-4q5r on 2026-11-10 flagging the npm package trgrip as malware (CWE-506, embedded malicious code). Every version (= 0) is affected and no patched version exists, so any installation is considered a full compromise of the host machine. The advisory warns that attackers may have obtained full control of affected computers, meaning removal of the package does not guarantee removal of the malicious software. All secrets and keys stored on affected machines should be treated as stolen. The package reportedly sees around 1,421 downloads per month. There is no fix; remediation is removal plus credential rotation and host forensics/rebuild.
What to do
- Remove trgrip from all projects and lockfiles immediately
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild or forensically clean affected hosts; do not assume package removal removed the malware
- Audit CI/CD and developer machines that may have installed the package for signs of compromise
- Check dependency trees and lockfiles for trgrip and block it in package registries/proxies
Sources
All live incidents on Threat Watch
