If your own package was compromised, lock down the publishing account first, revoke every token, report the bad versions to the registry, publish a clean higher version, and tell users which versions are affected. Speed matters because every hour the bad version is available, more people install it.
Order of work
The goal is to stop new harm, then help people already affected. Most maintainers do this alone, so a short fixed order helps.
First 24 hours
- Stop access. Change the account password, reset two factor, revoke all sessions and every publish token. npm supports only granular tokens, which can be revoked individually, and tokens lose access when the owner loses access to the package.
- List what was published. Compare the registry version list and publish times against your own release records. Note every version you did not release.
- Report to the registry. npm lets you report malware from the package page with the package name and all affected versions. Per its docs, npm Security confirms the report, removes the package and publishes a security placeholder and advisory. PyPI offers a Report project as malware link on the project page.
- Publish a clean version. Use a new, higher version number from a known clean machine. Do not reuse the removed number.
- Deprecate or flag bad versions where the registry allows it, with a message that points to the fix.
- Tell users. Post a notice in the repository, README and any mailing list with exact affected versions, the time window, what the code did if known, and what to do.
- Check your other packages and CI. An attacker who held your account may have touched more than one project.
- Find the entry point. Phishing, a leaked token or a compromised workflow. Fix it before the next release.
What to put in the notice
Keep it factual: affected versions, window, symptoms, remediation steps and a contact. Do not speculate about who did it. If you do not know what the code did, say so and advise rotating secrets on any machine that installed it.
Afterwards
Move to trusted publishing or short lived tokens where supported, require two factor on every maintainer and keep a second maintainer able to act when you are away. See the first day checklist for consumers of a compromised maintainer package to understand what your users will do.
If you work in a team
A project with several maintainers should name one person to run the response and one to write the public notice. Share the registry report between them so it is sent once, with complete information. Agree who can contact the registry, who talks to affected downstream projects and who updates the repository. After the first day, hold a short review and record the entry point, since the same route will be tried again.
Quick check
Can I reuse the same version number for a fixed release?
No. Publish a new higher version. Registries generally do not allow republishing a removed version.
Who do I tell first, users or the registry?
Lock the account and report to the registry first, then notify users. They can happen within the same hour.
Sources
Last reviewed: 19 October 2026.
