GitHub flags npm package @greenlake/common-context as malware

What happened

On 26 October 2026, the GitHub Advisory Database published and reviewed an advisory classing the npm package @greenlake/common-context as malware. The advisory lists all versions as affected, and no fixed release exists.

GitHub says any computer where the package was installed or has run should be regarded as fully compromised. Because an outside party may have gained full control of such a machine, uninstalling the package is not guaranteed to clear everything it left behind.

Timeline

1. 26 Oct 2026

   GitHub publishes the malware advisory.[1]

Who is affected

Any computer on which the package is installed or running.

What to do

1. Using a different, clean computer, rotate every secret and key that was stored on an affected machine straight away.
2. Remove the package.