MalwarePublished 13 Nov 2026

dowload_ebok_sprint_by_jake_knapp_braden_kowitz_john_zeratsky_4esvc (npm) · Malicious Code

Affects dowload_ebok_sprint_by_jake_knapp_braden_kowitz_john_zeratsky_4esvcSource GCVE Database

Malicious package : remove dowload_ebok_sprint_by_jake_knapp_braden_kowitz_john_zeratsky_4esvc and rotate any secrets on hosts that installed it.

Data as of 14 Nov 2026, 00:03 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-19849

What to do

Remove dowload_ebok_sprint_by_jake_knapp_braden_kowitz_john_zeratsky_4esvc from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdowload_ebok_sprint_by_jake_knapp_braden_kowitz_john_zeratsky_4esvc	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'dowload_ebok_sprint_by_jake_knapp_braden_kowitz_john_zeratsky_4esvc' contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee eradication of all malicious software introduced by it.

Impact

Full compromise of the affected computer, including potential unauthorized access to all stored secrets and keys. This level of compromise implies that attackers may have persistent control and can exfiltrate sensitive data or perform further malicious activities.

Defensive guidance

Immediately remove the malicious package from the affected system. Rotate all secrets and keys stored on the compromised computer from a separate, secure machine. Due to the possibility of persistent malicious software beyond the package itself, consider a full system reinstallation or forensic analysis to ensure complete remediation.

Summary

This threat involves a malicious npm package named 'dowload_ebok_sprint_by_jake_knapp_braden_kowitz_john_zeratsky_4esvc'. According to the source (ghsa-malware), installation or execution of this package results in full system compromise. The attacker potentially gains complete control over the affected computer. Due to the severity of the compromise, all stored secrets and keys must be rotated from a separate, secure environment. The package removal is necessary but insufficient to fully remediate the infection, as additional malicious components may persist.

References

github.com/advisories/GHSA-hc6c-rrvw-f289 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Nov 2026, 00:03 UTC

Technical details

References

Community reviews