MalwarePublished 3 Nov 2026

ib3rwn (npm) · Malicious Code

Affects ib3rwnSource GCVE Database

Malicious package : remove ib3rwn and rotate any secrets on hosts that installed it.

Data as of 3 Nov 2026, 20:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18544

What to do

Remove ib3rwn from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmib3rwn	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The ib3rwn package on npm contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but due to the extent of the compromise, removal alone may not eliminate all malicious software. Secrets and keys should be rotated from a different, secure computer.

Impact

Systems with the ib3rwn package installed or running are considered fully compromised, with attackers potentially having full control over the system. All secrets and keys stored on the compromised system are at risk and should be rotated immediately. The presence of this package indicates a severe security breach that may not be fully remediated by package removal alone.

Defensive guidance

Remove the ib3rwn package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines using a separate, secure computer. Due to the high risk of persistent compromise, consider rebuilding or thoroughly cleaning affected systems to ensure complete removal of malicious software.

Summary

The ib3rwn npm package is identified as containing malicious code that results in full system compromise when installed or executed. The compromise includes potential unauthorized access to all secrets and keys stored on the affected machine. The advisory strongly recommends removing the package and rotating all secrets and keys from a separate, uncompromised system. However, it warns that removal of the package may not fully eradicate all malicious components introduced by the attacker.

References

github.com/advisories/GHSA-gm4c-56vq-fvc9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 3 Nov 2026, 20:17 UTC

Technical details

References

Community reviews