rabbitmq`¶

Source: GitHub Security Advisories feed (multiple GHSA entries published 2026-02-04/05 UTC)

What happened¶

A set of new npm packages were flagged as malware / embedded malicious code on GitHub Security Advisories:

tailwindcss-forms-starter (GHSA-2rc6-vjw6-pg8x)
cat-retail-app (GHSA-c8q4-36x7-q9xp)
@jes4l/react-pkg (GHSA-g32q-5m39-h362)
locate-path_updated (GHSA-5h6m-mvmj-68rj)
express_update (GHSA-w2xr-35pg-j36q)
log-symbols_updated (GHSA-gm92-8pqf-v32m)
@purecore/rabbitmq (GHSA-5v54-wrvc-9wq7)

Pattern: multiple packages appear to be typosquat / lookalike names targeting popular libraries.

Installing a malicious dependency can:

Execute attacker-controlled scripts at install/build time (preinstall/postinstall, prepare, etc.)
Exfiltrate secrets from developer machines and CI (API keys, cloud creds, signing keys)
Backdoor produced artifacts

If any of these packages are present in your environment, treat it as an incident.

Identify exposure
Search repos and build artifacts for the package names.
Check package-lock.json / pnpm-lock.yaml / yarn.lock, CI logs, and artifact SBOMs.
Assume compromise for affected hosts
Quarantine the machine/runner.
Collect evidence before cleanup when feasible (process list, persistence points, network logs).
Rotate secrets (from a clean machine)
CI tokens, npm tokens, GitHub tokens, cloud keys, database creds, SSH keys.
Remove and prevent recurrence
Remove the malicious dependency and rebuild from trusted sources.
Add allowlists/denylists (e.g., block unknown scopes, enforce registries).
Enable dependency pinning + provenance where possible.