@walknpm/todo-cli npm package is malware — full machine compromise for installers of v2.0.1 (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
GitHub's advisory database published a malware advisory (GHSA-p6gj-69gx-r376) for the npm package @walknpm/todo-cli, version 2.0.1, classified under CWE-506 (embedded malicious code). GitHub states any computer with the package installed or running should be considered fully compromised, implying attacker-controlled code execution and potential theft of secrets and keys; no patched version exists and the package has no known source code. The package sees roughly 551 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software, since full control of the machine may have been handed to an outside entity. Affected users must rotate all secrets from a clean machine and rebuild/reimage compromised systems.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a different, clean computer
- Remove @walknpm/todo-cli@2.0.1 from all projects and lockfiles
- Reimage or fully rebuild affected machines; do not assume removal of the package eliminates the malware
- Audit systems for signs of compromise and unexpected outbound connections
- Block/flag the package in internal registries and CI to prevent reinstalls
Sources
All live incidents on Threat Watch
