Skip to content

2026-02-04 — NPM malware packages: react-vite-sync, react-count-sync, web3-chain-sync

GitHub published malware advisories for multiple NPM packages:

  • react-vite-sync (GHSA-6c8f-x4v8-69pr)
  • react-count-sync (GHSA-g8h5-29pj-64xq)
  • web3-chain-sync (GHSA-p3xm-qpjg-2gg8)

All advisories include language equivalent to:

Any computer that has this package installed or running should be considered fully compromised.

What to do (defender-focused)

  1. Treat as an incident
  2. Assume compromise of the host(s) where the package was installed/built/run.

  3. Rotate all secrets that could have been present on the host (tokens, API keys, SSH keys, cloud creds) from a clean machine.

  4. Identify exposure

  5. Search for the package names in:
    • package.json
    • package-lock.json / yarn.lock / pnpm-lock.yaml

  6. Use npm ls <pkg> to identify whether it was a transitive dependency.

  7. Contain + eradicate

  8. Remove the package and revert lockfiles to a known-good commit.

  9. If this occurred on a developer workstation or CI runner, consider re-imaging rather than “cleaning”.

  10. Add guardrails

  11. Prefer lockfiles committed to source control.
  12. Consider npm --ignore-scripts where feasible (install scripts are a common malware execution vector).
  13. Run dependency policy checks in CI (allowlists/denylists, provenance, SCA).

References

  • GitHub advisory: https://github.com/advisories/GHSA-6c8f-x4v8-69pr
  • GitHub advisory: https://github.com/advisories/GHSA-g8h5-29pj-64xq
  • GitHub advisory: https://github.com/advisories/GHSA-p3xm-qpjg-2gg8