MalwarePublished 29 Oct 2026

dowload_ebok_armageddon_by_max_hastings_kv3s4 (npm) · Malicious Code

Affects dowload_ebok_armageddon_by_max_hastings_kv3s4Source GCVE Database

Malicious package : remove dowload_ebok_armageddon_by_max_hastings_kv3s4 and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 23:01 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18397

What to do

Remove dowload_ebok_armageddon_by_max_hastings_kv3s4 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdowload_ebok_armageddon_by_max_hastings_kv3s4	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'dowload_ebok_armageddon_by_max_hastings_kv3s4' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets from a different, uncompromised device is strongly advised. However, removal of the package alone may not fully eliminate the malicious presence due to potential persistence mechanisms.

Impact

Full system compromise on any computer with the package installed or running. Attackers may gain unauthorized access to all secrets and keys stored on the device. The compromise is severe enough that secrets must be rotated from a different machine, indicating a high level of breach and potential persistence of malicious code beyond simple package removal.

Defensive guidance

Immediately remove the 'dowload_ebok_armageddon_by_max_hastings_kv3s4' package from affected systems. Rotate all secrets and keys from a separate, uncompromised computer. Due to the likelihood of full system compromise, consider rebuilding the affected system or conducting a thorough forensic analysis to ensure complete removal of malicious components.

Summary

This threat involves a malicious npm package named 'dowload_ebok_armageddon_by_max_hastings_kv3s4' identified by the GHSA malware source. The package, when installed or executed, can fully compromise the host computer, granting attackers control and access to sensitive information such as stored secrets and keys. The advisory emphasizes that the system should be considered fully compromised and that secrets must be rotated from a separate, secure machine. Removal of the package is recommended but may not guarantee complete remediation due to possible additional malware components installed alongside.

References

github.com/advisories/GHSA-p6mc-228w-6q75 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 23:01 UTC

Technical details

References

Community reviews