MalwarePublished 29 Oct 2026

orderbook-volt-plugin (npm) · Malicious Code

Affects orderbook-volt-pluginSource GCVE Database

Malicious package : remove orderbook-volt-plugin and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 20:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18393

What to do

Remove orderbook-volt-plugin from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmorderbook-volt-plugin	Affected =0.0.2 =0.0.1 =0.0.0-stage	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The orderbook-volt-plugin npm package versions 0.0.0-stage, 0.0.1, and 0.0.2 contain malicious code. Any computer with this package installed or running should be considered fully compromised. Secrets and keys stored on the affected system must be rotated immediately from a different, clean machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.

Impact

Systems with the affected versions of orderbook-volt-plugin installed are fully compromised, allowing attackers complete control over the computer. This compromises confidentiality and integrity of all secrets and keys stored on the system. The malicious code can persist beyond package removal, increasing the risk of ongoing unauthorized access and data theft.

Defensive guidance

Immediately remove the orderbook-volt-plugin package versions 0.0.0-stage, 0.0.1, and 0.0.2 from all affected systems. Rotate all secrets and keys that were stored on the compromised machines from a separate, secure computer. Because the system may remain compromised even after package removal, consider rebuilding or thoroughly cleaning affected systems to ensure complete eradication of malicious software.

Summary

The orderbook-volt-plugin npm package in versions 0.0.0-stage, 0.0.1, and 0.0.2 contains embedded malicious code that compromises the host system. Installation or execution of this package grants full control of the computer to an outside entity, potentially exposing all stored secrets and keys. Due to the severity of the compromise, complete remediation requires rotating all secrets from a separate trusted environment and removing the package, although removal may not fully eliminate all malicious components.

References

github.com/advisories/GHSA-w9pq-6r9f-pj96 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 20:15 UTC

Technical details

References

Community reviews