GitHub flags npm package dowload_ebok_armageddon_by_max_hastings_kv3s4 as malware

What happened

On 29 October GitHub's advisory database published a malware entry for the npm package dowload_ebok_armageddon_by_max_hastings_kv3s4. The entry says the package is malware and that no patched version exists. It records the weakness as embedded malicious code.

According to the advisory, any computer where the package was installed or running should be considered fully compromised. GitHub warns that uninstalling it may not clear every piece of malicious software it left behind.

Timeline

1. 29 Oct 2026

   GitHub publishes and reviews the malware advisory.[1]

Who is affected

Any computer that has had dowload_ebok_armageddon_by_max_hastings_kv3s4 installed or running.

What to do

1. Remove the package.
2. From a different computer, rotate every secret and key that was stored on the affected machine.