Skip to content

2026-02-04 — NPM malware in internallib_v157 (GHSA-h23p-rf86-54wq)

Source: GitHub Advisory Database (published 2026-02-05 UTC)

What happened

GitHub published a malware advisory for the npm package:

  • internallib_v157 (GHSA-h23p-rf86-54wq)

The advisory notes that any machine with this package installed should be considered fully compromised.

Why you should care

Malicious npm packages commonly:

  • Run attacker code during install/build via lifecycle scripts (preinstall/postinstall/prepare)
  • Exfiltrate secrets from developer machines and CI runners
  • Establish persistence or backdoor build artifacts

Action (defenders)

If this package appears in any repo, lockfile, cache, or CI logs, treat it as an incident.

  1. Identify exposure
  2. Search for internallib_v157 across repos and CI logs.

  3. Check lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) and dependency trees.

  4. Assume host compromise

  5. Quarantine impacted developer machines / build runners.

  6. Preserve evidence where feasible (process list, persistence locations, logs).

  7. Rotate secrets from a clean machine

  8. npm tokens, GitHub tokens, CI secrets, cloud keys, SSH keys, signing keys.

  9. Eradicate + prevent recurrence

  10. Remove the dependency, rebuild from trusted sources, invalidate caches.
  11. Add policy controls (registry allowlists, dependency review, provenance/SBOM gates).

Guidance

References

  • https://github.com/advisories/GHSA-h23p-rf86-54wq