xsdsh-purge-next (npm): malicious package compromises any machine where it is installed
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub's advisory database published GHSA-qpc3-24mv-6qrp on 2026-11-11 flagging the npm package xsdsh-purge-next version 1.0.0 as embedded malware (CWE-506). The advisory states that any computer with the package installed or running should be considered fully compromised, implying the malicious code grants an outside entity full control of the host. All secrets and keys on affected machines should be treated as stolen. There are no patched versions and no known legitimate source code; the package (~190 downloads/month) should be removed, though removal cannot guarantee the malware is fully eradicated. No specific campaign name, actor, or attack date is given.
What to do
- Treat any machine where xsdsh-purge-next@1.0.0 was installed as fully compromised; rotate all secrets and keys from a clean machine immediately
- Remove the package and rebuild/reimage affected systems rather than trusting cleanup
- Audit CI/CD and developer machines for the package and review logs for post-install activity
- Block xsdsh-purge-next in dependency allowlists and check lockfiles for transitive references
Sources
All live incidents on Threat Watch
