vfat-tools (npm): malicious package compromises any machine where installed; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub's malware advisory database has flagged the npm package vfat-tools as containing embedded malicious code (CWE-506). All published versions (= 0) are affected and there are no patched versions, meaning no version can be safely used. The advisory states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. The package sees roughly 458 downloads per month. Removal of the package alone is not guaranteed to eliminate all malicious software it may have installed. Developers and CI systems that pulled vfat-tools should treat secrets and keys on those machines as stolen and rotate them from a clean computer.
What to do
- Treat any machine with vfat-tools installed as fully compromised; rotate all secrets and keys from a different, clean computer
- Remove the package and rebuild/reimage affected machines and CI runners where feasible
- Audit dependency trees and lockfiles for vfat-tools and block/reject it in registries and CI
- Review logs and network traffic for signs of exfiltration or attacker access
- Rotate credentials, tokens, and signing keys that may have been accessible to compromised environments
Sources
All live incidents on Threat Watch
