Malicious npm package wfx steals credentials via postinstall

published 2026-11-13

The wfx package runs a credential stealer in its npm postinstall script, so installing it hands the attacker secrets readable on your machine, such as npm and GitHub tokens, SSH keys and API keys. The package was pushed to at least 1,800 GitHub repos using stolen maintainer tokens, so it can arrive through normal dependency installs.

Source: @abepolishchuk on X

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 3385 and your operating system.