MalwarePublished 22 Oct 2026Updated 29 Oct 2026

@lumen-labs-dev/whisper-node (npm) · Malicious Code

Affects @lumen-labs-dev/whisper-nodeSource GCVE Database

Malicious package : remove @lumen-labs-dev/whisper-node and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:34 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18194

What to do

Remove @lumen-labs-dev/whisper-node from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@lumen-labs-dev/whisper-node	Affected =0.5.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @lumen-labs-dev/whisper-node version 0.5.1 is identified as malicious. Installation of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised device is strongly advised.

Impact

Systems with @lumen-labs-dev/whisper-node version 0.5.1 installed are at risk of full compromise. Attackers may gain complete control over the affected computer, potentially accessing all stored secrets and keys. This compromises confidentiality, integrity, and availability of the system and its data.

Defensive guidance

Remove the @lumen-labs-dev/whisper-node package version 0.5.1 immediately. Rotate all secrets and keys stored on the compromised computer from a different, secure device. Because full control may have been given to an attacker, additional forensic analysis and remediation may be necessary to ensure complete removal of malicious software.

Summary

The package @lumen-labs-dev/whisper-node version 0.5.1 has been flagged as malicious by the GHSA malware source. Although static analysis by Amazon Inspector did not detect typical supply-chain attack patterns or backdoors within the package contents, the GHSA malware advisory states that any system with this package installed should be considered fully compromised. The package may grant an attacker full control over the host, necessitating credential rotation and package removal. No CVSS score is assigned, and no known exploits in the wild are reported.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:34 UTC

Technical details

References

Community reviews