Free tool: runs in your browser
Npm package compromise response checklistif a compromised npm package version may have been installed
TimeBinder adds a layer of protection against AI and human fraud and disputes. Check where a bad version may have been installed, whether install scripts ran, what the installing machine or CI job could read, what you rotate and rebuild, and the dated copies you can still show.
Nothing you tick is sent anywhere. This page cannot scan your projects or tell you whether a machine was compromised. It is not security or legal advice.
Check the lockfiles, the logs, the secrets and the copies you can still show
Tick what is true about your projects and CI jobs. You get a shareable result and clear next steps. Nothing you tick is sent to TimeBinder.
Your choices stay on this page. Nothing you tick is sent anywhere or tied to your name.
Tick everything that is true about a possibly compromised npm package version
This looks at where a bad version may have been installed, whether install scripts ran, what the installing machine or CI job could read, what you rotate and rebuild, and the dated copies you can still show. It is not a scan and not a way to tell whether a machine is clean.
What to do now
What should I do if a compromised npm package version may have been installed? The short answer
Search first, then treat any machine that ran the install as exposed. The Hacker News reported on 9 November 2026 that attackers used Ethersphere’s own release automation to publish bee-js 13.3.0, which was the latest version on npm for about 75 minutes and ran its code as a postinstall script. The GitHub advisory it quotes says any computer that has the package installed or running should be considered fully compromised. The reported steps: search lockfiles, package caches, internal registries and CI install logs for the exact version, pin the earlier version, clear cached copies, rotate every password, token and key the installing user or job could read from a clean computer, and rebuild where possible. Updating or removing the package does not remove a backdoor already installed.
This checklist cannot scan your projects or tell you whether a machine is clean. A TimeBind of a file you already hold, such as a lockfile or a CI install log, can show that exact file existed no later than a recorded time and still matches. It does not show whether malicious code ran.
Why this came up in November 2026
On 9 November 2026 The Hacker News reported that attackers published malicious versions of two Ethersphere tools, the npm package bee-js 13.3.0 and Swarm Desktop 0.56.2, through the project’s own release automation. It said bee-js 13.3.0 was the latest npm version for about 75 minutes, that its code ran as a postinstall script so a project did not need to import the library, that both releases were taken down, and that no theft of funds had been reported at the time of writing. The article adds that taking a release down does not remove a backdoor already installed. These are the report’s statements, and this page does not treat them as more than that.
It was not the only npm and CI story that week. On 11 November 2026 the security company Depi described a chain of flaws in OpenAI’s Codex release pipeline that it says could have let it control publishing of the official npm package, and said OpenAI deployed a fix right away.
Measured demand is steady rather than viral. Checked on 13 November 2026, about 3:15 AM Australia/Brisbane. Google autocomplete returned “npm package compromised”, “npm package compromised list”, “npm packages compromised reddit” and “npm compromised what to do”. Autocomplete shows what people type. It is not search volume.
TimeBinder also published an article on the bee-js compromise. This checklist applies the same order of steps to any package, not only that one. Always read the advisory for the package you use.
Sources: The Hacker News, 9 November 2026 and Depi, 11 November 2026.
What this checklist does and does not do
The honest job of this page is to put the steps in the right order, search, treat as exposed, rotate, rebuild, not to audit any project. See also the glossary entries for existed no later than and fingerprint.
| Part | What it does | What it does not do |
|---|---|---|
| Where it may be | Reminds you to search lockfiles, caches, registries and CI logs for the exact bad version, including copies pulled in by other packages. | Search your projects for you. |
| Exposure and rotation | Reminds you to treat a machine or runner that ran the install as exposed, list what it could read and rotate from a clean computer. | Tell you whether a secret was stolen. |
| Persistence and rebuild | Reminds you to check the advisory for persistence and to rebuild from a trusted image where possible. | Find or remove a backdoor. |
| A TimeBind of a file you already hold | Records that an exact file existed no later than a recorded time and still matches, using a SHA-256 fingerprint made in your browser. The file stays on your device. | Show that no malicious code ran, or that a machine is clean. |
If a lockfile or an install log is something you may need to show later
Before you clean up:
- Keep dated copies of the lockfile, the CI install logs and the package cache listing as they stand.
- Make a TimeBind of each exact file you already hold. The fingerprint is made in your browser and the file stays on your device. You can later download a Proof of Time Certificate.
- Store the files, the list of secrets you rotated and the certificate together, with a note of when you rotated each one.
A TimeBind shows the exact file existed no later than the recorded time and still matches. It cannot show whether malicious code ran.
First Pooled TimeBind free, no card, then from US$5. An ASAP TimeBind is US$15.
What a TimeBind shows, and what it does not. It shows that an exact file existed no later than a recorded time and that a copy shown later still matches its fingerprint. It does not show who made the file, who owns it, that its contents are true, or whether AI was used to make or edit it. This is general information, not legal advice.
If the attack came through a hijacked GitHub account and your CI workflows, see also the free GitHub Actions secret exposure response checklist.
npm package compromise response checklist: FAQ
Is updating the package enough?
Not by itself, according to the report. It says taking down or removing a release does not remove a backdoor already installed, so check the advisory for persistence and consider rebuilding the machine from a trusted image.
Why does a postinstall script matter?
npm runs install scripts automatically during installation unless they are turned off, so a project did not need to import the package for the code to run. Check how your installs and CI jobs are set up.
Should I rotate secrets from the same machine?
The report says to rotate from a clean computer, because secrets typed on a machine that may be exposed can be seen.
Does a dated record show my machine is clean?
No. A TimeBind of a file you already hold, such as a lockfile or a log, can show that exact file existed no later than a recorded time and still matches. It does not show that malicious code did not run.
Is this checklist a security audit?
No. It runs in your browser and only helps you plan the order of the checks. For a real incident, follow your organisation’s security process.
Is anything I tick sent to TimeBinder?
No. The checklist runs in your browser. Your ticks stay on the page.
Related guides and tools
- Ethersphere bee-js npm compromise: what developers should keepThe TimeBinder article on this incident
- npm trusted publishing checklistA checklist for the publishing side
- GitHub Actions workflow lockfile checklistA neighbouring job for CI workflows
- AI coding assistant settings file secrets checklistRotate first, then clean up
- Developer timestampingThe TimeBinder hub for developer file records
- GlossaryPlain definitions of fingerprint, SHA-256 and existed no later than
- All free toolsPrivate, in-browser tools
Date the exact files you already hold
Add a layer of protection against AI and human fraud and disputes: a dated, checkable record of the exact lockfiles and logs, kept before you clean up.
- Open the app and sign in with email or Google.
- Add your files. They stay on your computer.
- Seal them and download your Proof of Time certificates.
First Pooled TimeBind free, no card, then from US$5. See pricing.