zread_cli npm malware: malicious CLI and platform binaries fully compromise installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub's Advisory Database published four malware advisories on 2026-11-13 for the npm package zreadcli and three @zread/cli platform-specific binaries (darwin-arm64, darwin-x64, linux-arm64). All versions (= 0) are flagged as embedded malicious code (CWE-506) with no patched versions and no known source code, indicating a likely typosquat or hijacked package rather than a compromised legitimate release. The advisories state any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to stored secrets and keys. Combined downloads are modest (~440/month), limiting reach, but any installation is treated as an active compromise. No fix exists; removal of the package does not guarantee removal of the malicious software.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where zread_cli or any @zread/cli-* binary was installed, using a clean machine
- Isolate and rebuild affected machines from trusted images; do not rely on uninstalling the package
- Audit npm lockfiles and CI/CD environments for zread_cli or @zread/cli-* and block these packages
- Review logs and network traffic for signs of exfiltration or attacker access following installation
Sources
All live incidents on Threat Watch
