GitHub flags npm package vas-tops2-core-property-search as malware

What happened

On 30 October GitHub's advisory database published a malware entry for the npm package vas-tops2-core-property-search. The entry says the package is malware and that no patched version exists. It records the weakness as embedded malicious code.

According to the advisory, any computer where the package was installed or running should be considered fully compromised. GitHub warns that uninstalling it may not clear every piece of malicious software it left behind.

Timeline

1. 30 Oct 2026

   GitHub publishes and reviews the malware advisory.[1]

Who is affected

Any computer that has had vas-tops2-core-property-search installed or running.

What to do

1. Remove the package.
2. From a different computer, rotate every secret and key that was stored on the affected machine.