npm malware: dowload_ebok_armageddon_by_max_hastings_kv3s4 — malicious package fully compromises installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
GitHub's malware advisory database published GHSA-p6mc-228w-6q75 on 2026-10-29 flagging the npm package dowloadebokarmageddonbymaxhastingskv3s4 as embedded malicious code (CWE-506). The package, apparently a fake ebook-download lure, has no legitimate source code and no patched versions; all versions (= 0) are affected. GitHub states any computer with the package installed or running should be considered fully compromised, with attackers potentially having full remote control and access to secrets and keys. Downloads are low (~10/month), limiting reach, but any installation is treated as an active compromise. There is no fix; the only remediation is removal plus incident response, since uninstalling may not remove all malicious software.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a different, clean computer
- Isolate and reimage/rebuild affected machines rather than relying on uninstalling the package
- Audit dependency locks and CI caches for the package name and block it in registries/proxies
- Review logs and network traffic for signs of attacker access following installation
Sources
All live incidents on Threat Watch
