GitHub flags npm package depfix-ai as malware posing as AI tool

GitHub's Advisory Database and the OSSF malicious-packages project disclosed on November 12, 2026, that the npm package depfix-ai, marketed as an AI tool that automatically fixes breaking API changes, is malicious in every version it has ever published. The disclosure is detailed in Malicious code in depfix-ai (npm).

What changed

• GitHub Advisory Database published the advisory GHSA-689j-99g2-vf2f for the npm package depfix-ai on November 12, 2026
• The OSV and OSSF malicious-packages project track the same package under the identifier MAL-2026-19197
• depfix-ai was marketed as an AI tool that detects breaking API or SDK changes, patches the affected call sites, runs tests and opens pull requests
• Every published version of depfix-ai is malicious, and no patched release exists
• The advisory is classified under CWE-506, Embedded Malicious Code, with Critical severity

What it means for people who build with AI

The case shows attackers are branding malicious supply-chain packages specifically as AI coding tools to lure developers into installing them. Anyone who relies on agentic coding tools or automated dependency fixers should scrutinize AI-labeled npm packages just as carefully as any other unverified dependency, since the AI label itself is now being used as bait.

What to do now

The advisory states that any computer where depfix-ai has been installed or run should be considered fully compromised. The recommended remediation is to remove the package entirely and rotate all secrets and keys from a clean machine.

Sources

• Malicious code in depfix-ai (npm) (GitHub Advisory Database, November 12, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.