Malicious npm package dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc — full system compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
GitHub's malware advisory database published GHSA-j272-m9j4-g3v9 on 2026-10-29 flagging the npm package dowloadebokelpisomilelpisomil1bykatharinemcgeeh1llc as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, so removal of the package alone cannot be assumed to remove all malicious software. All versions (= 0) are affected and no patched version exists. The package appears to be a fake ebook-download package with very low usage (~2 downloads/month), typical of typosquat or SEO-lure malware. No CVE is assigned; the advisory is reviewed malware classification.
What to do
- If the package is installed, treat the machine as fully compromised and rotate all secrets and keys immediately from a clean computer
- Remove the package and rebuild/reimage affected machines rather than relying on uninstall
- Audit npm lockfiles and CI caches for the package name and block it in dependency firewalls/allowlists
- Review systems for persistence and unauthorized access following exposure
Sources
All live incidents on Threat Watch
