MalwarePublished 11 Aug 2026

dakumangalsingh_virus (npm) · Malicious Code

Affects dakumangalsingh_virusSource GCVE Database

Malicious package : remove dakumangalsingh_virus and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:48 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13761

What to do

Remove dakumangalsingh_virus from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdakumangalsingh_virus	Affected =1.3.0 =1.2.0 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dakumangalsingh_virus contains a 455 KB Windows PE64 executable named DakuMangalSingh.exe. The package itself does not execute the binary during installation or import, as no lifecycle scripts or entry points trigger it. However, if a user manually executes the binary on a Windows system, it may cause harm. The package self-identifies as a virus and lacks documentation or source code. Systems with this package installed should be considered fully compromised, and all secrets and keys should be rotated from a clean environment.

Impact

If the DakuMangalSingh.exe binary is manually executed on a Windows host, the system may become fully compromised, potentially allowing an attacker full control. All stored secrets and keys on the affected system are at risk and should be rotated immediately from a different, trusted machine. Simply installing or importing the package does not cause harm, but the presence of the malicious binary poses a severe risk if executed.

Defensive guidance

Users should immediately remove the dakumangalsingh_virus package from any systems where it is installed. Because the package contains a malicious executable that can fully compromise a system if run, all secrets and keys stored on affected machines should be rotated from a clean environment. There is no indication of an official patch or fix; remediation involves removal and secret rotation. Normal npm install or require() does not execute the malicious binary, so avoid manually running the executable. Monitor for any signs of compromise and consider rebuilding affected systems.

Summary

The dakumangalsingh_virus npm package includes a malicious Windows executable (DakuMangalSingh.exe) alongside an empty index.js and no lifecycle scripts, meaning normal npm install or require() actions do not trigger execution. The package name explicitly labels it as a virus, and no legitimate functionality or source code is provided. According to the ghsa-malware source, any system with this package installed or running is considered fully compromised, necessitating immediate secret rotation and package removal. However, removal may not fully eliminate the threat due to potential persistent malicious activity initiated by the executable if run.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:48 UTC

Technical details

References

Community reviews