MalwarePublished 8 Aug 2026Updated 10 Aug 2026

statist-browser-typed-client-eventea.projects.pwakasko (npm) · Malicious Code

Affects statist-browser-typed-client-eventea.projects.pwakaskoSource GCVE Database

Malicious package : remove statist-browser-typed-client-eventea.projects.pwakasko and rotate any secrets on hosts that installed it.

Data as of 10 Aug 2026, 15:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13673

What to do

Remove statist-browser-typed-client-eventea.projects.pwakasko from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmstatist-browser-typed-client-eventea.projects.pwakasko	Affected =0.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package statist-browser-typed-client-eventea.projects.pwakasko version 0.0.1 is identified as malicious. Although no direct code patterns for credential theft, network exfiltration, or persistence were observed, the package is considered fully compromising to any system where it is installed. Complete system compromise is assumed, and all secrets and keys on affected systems should be rotated immediately. Removal of the package alone may not eliminate all malicious components introduced by its installation.

Impact

Systems with this package installed are considered fully compromised. Attackers may have gained complete control, risking exposure of all stored secrets and keys. The package's installation implies a severe security breach, and simply uninstalling the package does not guarantee removal of all malicious artifacts.

Defensive guidance

Remove the malicious package immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted computer. Due to the likelihood of full system compromise, consider rebuilding the system or conducting a thorough forensic analysis to ensure all malicious components are eradicated.

Summary

The npm package statist-browser-typed-client-eventea.projects.pwakasko version 0.0.1 is classified as malicious software. Analysis from amazon-inspector found no explicit code for credential access or network exfiltration, but the GHSA-malware source indicates that any system with this package installed should be considered fully compromised. The package contains only two files, with no lifecycle hooks or suspicious network destinations detected. Despite this, the presence of the package implies a full compromise, necessitating immediate secret rotation and removal of the package, although removal may not fully clean the system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 15:54 UTC

Technical details

References

Community reviews