@unipswap/postcss-animate-units: malicious npm package fully compromises machines running it (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database published GHSA-vh4f-84vw-hprv on 2026-11-10 flagging the npm package @unipswap/postcss-animate-units as embedded malicious code (CWE-506). All published versions (= 0) are affected and no patched version exists; the package has no known source code. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying attackers may have obtained full control, including access to secrets and keys. Reach appears limited (~13 downloads/month), but any installation is treated as an active compromise rather than a latent risk. Removal of the package alone is not guaranteed to remove the malicious software. There is no vendor fix; remediation is incident response on affected machines.
What to do
- Treat any machine with the package installed as fully compromised; isolate and forensically review it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Remove the package and block/flag @unipswap/postcss-animate-units in npm registries and dependency allowlists
- Audit dependency trees and CI caches for the package and rebuild affected artifacts from clean sources
- Review logs for signs of attacker activity following installation
Sources
All live incidents on Threat Watch
