vibes-plug (npm) — malicious package version 4.5.0 fully compromises installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's malware advisory database published GHSA-xfv7-hqg2-67x3 on 2026-11-03 flagging version 4.5.0 of the npm package vibes-plug as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with attackers potentially having full remote control and access to secrets and keys. The package has roughly 178 monthly downloads and 91 GitHub stars, indicating a small but real install base. No patched versions exist and no source code is known; the advisory recommends removal of the package, though removal cannot guarantee elimination of all malicious software planted during installation. Users must rotate all credentials from an uninfected machine.
What to do
- Rotate all secrets, keys, and credentials stored on machines where vibes-plug 4.5.0 was installed, using a clean computer
- Remove vibes-plug 4.5.0 from all projects and lockfiles and audit for persistence mechanisms left behind
- Rebuild or thoroughly forensically clean affected machines; do not trust removal alone
- Check npm audit logs and CI systems for installs of the package and scan for indicators of compromise
Sources
All live incidents on Threat Watch
