npm malware: @k18k/entrypoint-sdk platform packages and orqiva-runtime-win32-x64 fully compromise installed hosts
Severity: critical · Patch status: no-fix-needed · Since 2026-10-23
GitHub's advisory database published four critical malware advisories on 2026-10-23 covering npm packages @k18k/entrypoint-sdk-darwin-x64 (0.2.0, 0.2.1), @k18k/entrypoint-sdk-darwin-arm64 (0.2.0, 0.2.1), @k18k/entrypoint-sdk-linux-x64 (0.2.0, 0.2.1), and orqiva-runtime-win32-x64 (0.1.0). The packages contain embedded malicious code (CWE-506) and no patched versions exist; GitHub states any computer with these packages installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Any developer or CI system that installed these platform-specific binaries is affected. Removal alone is not guaranteed to eliminate the malicious software. Affected organisations must treat hosts as compromised, rotate all secrets from clean machines, and rebuild affected systems.
What to do
- Immediately remove the affected packages and treat all machines where they were installed or run as fully compromised
- Rotate all secrets, keys, and credentials stored on or accessible from those machines, using a different clean computer
- Rebuild or reimage affected developer workstations and CI runners rather than trusting cleanup
- Audit dependency lockfiles and install history for the affected package names and versions
- Block the packages in npm registries/proxies and monitor for reappearing lookalike packages
Sources
All live incidents on Threat Watch
