MalwarePublished 23 Oct 2026Updated 29 Oct 2026

@k18k/entrypoint-sdk-darwin-arm64 (npm) · Malicious Code

Affects @k18k/entrypoint-sdk-darwin-arm64Source GCVE Database

Malicious package : remove @k18k/entrypoint-sdk-darwin-arm64 and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:35 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18243

What to do

Remove @k18k/entrypoint-sdk-darwin-arm64 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@k18k/entrypoint-sdk-darwin-arm64	Affected =0.2.0 =0.2.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

@k18k/entrypoint-sdk-darwin-arm64 is a malicious npm package targeting the darwin-arm64 platform. Installation or execution of this package compromises the host computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised device is strongly advised.

Impact

Systems with this package installed or running are considered fully compromised. Attackers may have gained full control over the affected computer, risking exposure of all stored secrets and keys. Credential compromise is highly likely, necessitating immediate rotation of all secrets from a separate, secure device.

Defensive guidance

Remove the @k18k/entrypoint-sdk-darwin-arm64 package immediately. Rotate all secrets and keys stored on the affected computer from a different, uncompromised device. Due to the potential full system compromise, further forensic analysis and remediation may be required.

Summary

@k18k/entrypoint-sdk-darwin-arm64 is a platform-specific native artifact npm package for darwin-arm64 architecture. Although the package contents do not show installer-harming behaviors such as lifecycle scripts or network fetches, it is classified as malicious by GHSA malware sources. Any system with this package installed or running is considered fully compromised, with potential full control given to an external entity. The package versions 0.2.0 and 0.2.1 are affected. Removal of the package alone may not eliminate all malicious software introduced by it.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:35 UTC

Technical details

References

Community reviews