Malicious npm package dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t fully compromises hosts

Severity: critical · Patch status: no-fix-needed · Since 2026-10-29

GitHub published advisory GHSA-5cmc-vx46-22wx on 2026-10-29 flagging the npm package dowloadeboknurmalschnelldasmammutrettenbyknutkrugerevaschoffmanndavidovouz6t as malware (CWE-506, embedded malicious code). All versions (=0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to secrets and keys. The package appears to be a fake ebook-download package with very low reach (~7 downloads/month). Removal of the package does not guarantee removal of all malicious software, so affected machines require full remediation. No CVE is assigned; the package should be treated as compromised infrastructure rather than a vulnerable dependency.

What to do

Rotate all secrets, keys, and credentials stored on any machine where the package was installed, from a clean computer
Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software
Audit dependency trees and lockfiles for the package name and block it in registry proxies/allowlists
Review access logs and network activity from affected hosts for signs of attacker control
Report any related compromise indicators to your security team and GitHub/npm

Sources

Malware in dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t (github.com)

All live incidents on Threat Watch

Threat Watch– active

All incidents

More on Threat Watch

More unknown npm publisher incidents

Malicious npm package dowload_ebok_lolita_by_vladimir_nabokov_oy1gy — full system compromise on install Critical · Supply chain
Malicious npm packages m98th, m98bet, 789bet, m98vip — full system compromise on install Critical · Supply chain
npm typosquat malware: bcxhdh1kjlopsde & cjlowuxbnexkhgpzq — full machine compromise on install Critical · Supply chain
my-empty-package (npm): malicious package compromises machines that install it Critical · Supply chain
Malicious npm packages csec-form-validator, csec-crypto-toolkit (and ccsec- typosquat variants) — full system compromise Critical · Supply chain
Malicious npm packages: path-stream-utils-testmetest and @iobandamwer/native-helper — full system compromise on install (no CVE) Critical · Supply chain

Browse

Helix Cyber

Is your stack exposed? Get it tested.

The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.

Get a pentest How it works

Agent Virtualization

Enterprise Coding Agents

Private AI Platform

Digital Sovereignty

Follow the Sun

The Speed Advantage

Financial Services

GPU Cloud & Neoclouds

Public Sector & Defence

More on Threat Watch

More unknown npm publisher incidents

Browse

Is your stack exposed? Get it tested.