w-mousekey npm malware — package fully compromises machines that install it (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-25
GitHub's malware advisory database published GHSA-gmhr-j769-j6qf on 2026-10-25 flagging npm package w-mousekey version 1.0.42 as embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity. No patched versions exist and no known source code is available; the package has roughly 1,139 downloads per month. Removal of the package alone is not guaranteed to remove all malicious software it installed. Any developer or CI environment that installed w-mousekey 1.0.42 must treat secrets and keys on that machine as stolen and rotate them from a clean computer.
What to do
- Rotate all secrets, keys, and credentials stored on any machine that installed w-mousekey 1.0.42, using a different clean computer
- Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the system
- Audit dependency lockfiles and CI caches for w-mousekey and block the package in registries/proxies
- Review access logs and monitor for suspicious activity from affected hosts
Sources
All live incidents on Threat Watch
