Malicious npm package dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p — full system compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
GitHub's malware advisory database published GHSA-h86m-7gvf-j79h on 2026-10-29 flagging the npm package dowloadebokreikisviluppaeusalenergiareikibymattharvey9q55p as embedded malicious code (CWE-506). The package, apparently a typosquat-style ebook downloader, receives roughly 9 downloads per month and every version (= 0) is affected with no patched version available. GitHub states any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, harvested secrets and keys, and deployed additional malware that persists after package removal. No fix exists; remediation is removal plus credential rotation.
What to do
- Treat any machine where the package was installed as fully compromised; rotate all secrets and keys from a clean machine
- Remove the package and rebuild/reimage affected systems
- Audit npm dependency trees and lockfiles for the package name
- Check for persistence mechanisms and follow-up malware on affected hosts
- Block the package in internal registries and CI
Sources
All live incidents on Threat Watch
