Malware in @webapp-shared/login-vmok npm package

critical severity · published 2026-10-27

The package can read and steal secrets on the machine, including npm, PyPI, GitHub, cloud, SSH and .env API keys. It may delete files if its stolen token is revoked, so remove it before rotating anything.

Source: GitHub Advisory

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1960 and your operating system.