@worca/app npm package: malicious code in 1.14.0-rc.2 fully compromises installed machines (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
GitHub's malware advisory database published GHSA-rmc5-cxrx-5fh9 on 2026-10-26 flagging version 1.14.0-rc.2 of the npm package @worca/app as containing embedded malicious code (CWE-506). The advisory states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. The package has roughly 3,986 weekly downloads and 40 GitHub stars, so exposure is limited but real. No patched version exists and no source code is known; the only remediation is removal plus full incident response on affected machines.
What to do
- Immediately rotate all secrets, keys, and credentials stored on or accessible from machines where @worca/app 1.14.0-rc.2 was installed, using a clean computer
- Remove the package from all projects and lockfiles and block/audit for it in dependency scanning
- Rebuild or wipe affected machines; treat them as compromised since removal may not eliminate implanted malware
- Review logs and network traffic from affected hosts for signs of exfiltration or attacker access
- Audit CI/CD runners and developer workstations that may have installed the package
Sources
All live incidents on Threat Watch
