MalwarePublished 13 Jul 2026Updated 5 Aug 2026

@omniwatch-wick/cli (npm) · Malicious Code

Affects @omniwatch-wick/cliSource GCVE Database

Malicious package : remove @omniwatch-wick/cli and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10486

What to do

Remove @omniwatch-wick/cli from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@omniwatch-wick/cli	Affected 0.1.0 – 0.1.4 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @omniwatch-wick/cli version 0.1.2 contains malicious code that collects host system identifiers and user information, then exfiltrates this data to attacker-controlled endpoints. This behavior is not part of any documented CLI functionality and represents an installer-side reconnaissance and data exfiltration beacon. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation from a different machine. Removal of the package alone may not eliminate all malicious software introduced.

Impact

Systems with @omniwatch-wick/cli version 0.1.2 installed are at high risk of full compromise. Sensitive host and user identity data is exfiltrated to attacker-controlled servers. Attackers may have gained persistent access, and all secrets and keys stored on the compromised system should be considered exposed and rotated. The presence of this package indicates a severe security breach with potential for further undetected malicious activity.

Defensive guidance

Immediate removal of the @omniwatch-wick/cli package version 0.1.2 is required. However, removal alone is insufficient due to the likelihood of additional malware. All secrets and keys stored on the compromised system must be rotated from a separate, trusted machine. Conduct a thorough investigation and system remediation to identify and eliminate any residual malicious software. Monitor for any unusual activity and consider rebuilding the affected system if full remediation cannot be assured.

Summary

The @omniwatch-wick/cli npm package version 0.1.2 includes code that requires modules such as child_process, os, http, and https to gather host identifiers including user info, hostname, and platform. It sends this information via POST requests to hardcoded, non-first-party Cloudflare Workers endpoints controlled by the package publisher. This exfiltration behavior indicates malicious intent, functioning as a reconnaissance and data collection beacon during installation. According to the ghsa-malware source, any system with this package installed should be considered fully compromised, with secrets and keys rotated immediately. The package removal does not guarantee full remediation due to potential additional malware.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Jul 2026, 09:21 UTC

Technical details

References

Community reviews