wrangler-deploy (npm) 1.5.5 is malware — full machine compromise, rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
GitHub's advisory database published GHSA-5vmf-xjrj-jqhh on 2026-10-30 flagging npm package wrangler-deploy version 1.5.5 as embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No patched version exists; the package has no known source code. The package sees roughly 386 downloads per month and 3 GitHub stars, limiting reach, but anyone who installed 1.5.5 must treat all secrets and keys on the affected machine as stolen. Removal of the package does not guarantee removal of any malicious software it installed. No CVE assigned; classified as malware rather than a vulnerability.
What to do
- Rotate all secrets, API tokens, and keys stored on any machine where wrangler-deploy 1.5.5 was installed, using a clean machine
- Remove wrangler-deploy 1.5.5 from all projects and lockfiles and audit for persistence mechanisms it may have installed
- Rebuild or wipe compromised machines rather than trusting cleanup
- Check CI/CD environments and caches for the package and review Cloudflare/Wrangler deployment credentials for misuse
- Block the package in internal registries and monitor for typosquats
Sources
All live incidents on Threat Watch
