published 2026-11-03
Installing one of these malicious npm packages runs attacker code on your machine: it can install background jobs that steal npm and GitHub tokens, SSH keys and the API keys in .env files. Some of these worms delete files when their stolen token is revoked, so the package must be fully removed before any secret is changed.
Source: @FatemahAlharbi on X
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1810 and your operating system.