Malicious npm package dowload_ebok_lolita_by_vladimir_nabokov_oy1gy — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
GitHub's advisory database published a malware advisory (GHSA-cjmr-6xg2-vf8h) for the npm package dowloadeboklolitabyvladimirnabokovoy1gy, an ebook-download-themed package containing embedded malicious code (CWE-506). All versions (= 0) are affected and there are no patched versions; the package will not be fixed. GitHub states that any computer with the package installed or running should be considered fully compromised, with attacker control of the machine, so secrets and keys stored on it must be treated as stolen. Reach appears limited (~7 downloads/month), but any installation grants full control to an outside entity. Removal of the package does not guarantee removal of the malicious software it installed. Affected users should treat the host as breached and rotate all credentials from a clean machine.
What to do
- Immediately isolate and rebuild any machine where the package was installed or run
- Rotate all secrets, keys, tokens and credentials stored on affected machines, from a clean computer
- Remove the package and audit for persistence mechanisms and additional malware it may have deployed
- Review npm dependency trees and lockfiles for the package and block it in registries/proxies
- Check access and CI logs for signs of attacker activity following installation
Sources
All live incidents on Threat Watch
