u-chan-secrets npm package malware: full machine compromise, rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub's malware advisory database flagged the npm package u-chan-secrets as containing embedded malicious code (CWE-506). Versions 5.2.1 and 5.2.2 are affected and no patched versions exist; the package has been removed from the advisory's fix path entirely. Any machine with the package installed or running should be treated as fully compromised, with an outside entity potentially holding full control. The package sees roughly 1,722 downloads per month, so downstream developers and CI environments may be affected. The advisory was published and reviewed on 2026-11-09. Because attackers may have deployed additional persistence, removing the package does not guarantee removal of all malicious software. Organisations should rotate all secrets and keys from a clean machine and rebuild affected systems.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where u-chan-secrets 5.2.1 or 5.2.2 was installed, using a different clean computer
- Remove the package and rebuild/reimage affected machines and CI runners, as removal may not eliminate attacker persistence
- Audit dependency lockfiles and block/reinstall from trusted sources; check for suspicious post-install activity and network connections
Sources
All live incidents on Threat Watch
