npm: 10 Malicious 'dowload_ebok_' Packages Disclosed in Under a Minute
On October 29, 2026, ten malicious npm packages, all sharing the `dowload_ebok_` prefix, were simultaneously disclosed, indicating a coordinated supply chain attack.
Key findings
- Ten malicious npm packages were disclosed on October 29, 2026, within a single minute.
- All packages share the common prefix
dowload_ebok_, indicating a coordinated campaign. - Each package was published just hours before its disclosure, suggesting a rapid malicious deployment.
- All associated GHSA advisories were rated Critical severity, implying severe system compromise upon installation.
- The package names appear to be themed around book titles, possibly to lure users.
On October 29, 2026, ten malicious packages were disclosed on the npm registry within a single minute, all part of a coordinated campaign identified by the common prefix dowload_ebok_. These packages were registered just hours before their disclosure at 22:14 UTC, suggesting a rapid deployment of malicious artifacts aimed at the npm ecosystem.
Campaign Signature
The defining characteristic of this burst is the consistent naming convention: all ten packages share the dowload_ebok_ prefix. This strong common prefix, combined with the extremely tight disclosure window, confirms a coordinated effort by an attacker. The full package names, such as dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc, dowload_ebok_lolita_by_vladimir_nabokov_oy1gy, and dowload_ebok_armageddon_by_max_hastings_kv3s4, appear to be themed around book titles, potentially as a lure for unsuspecting users or to evade automated detection systems through obfuscation.
Malicious Behavior
While specific behavioral findings from OpenSSF Package Analysis were not detailed for these advisories, the critical severity ratings assigned by GitHub Security Advisories (GHSA) strongly imply highly impactful malicious actions. Typically, critical vulnerabilities in packages can lead to arbitrary code execution, credential exfiltration, or full system compromise upon installation. The rapid registration and subsequent disclosure of these packages suggest they were designed to deliver a malicious payload to any system that installed them.
Severity and Impact
The critical severity assigned to these advisories means that any system that installed these malicious packages should be considered fully compromised. The potential impact includes, but is not limited to, unauthorized access to sensitive data, execution of arbitrary commands, and establishment of persistent backdoors. Users are strongly advised to immediately rotate all sensitive credentials and secrets from a separate, secure machine, as well as thoroughly audit their systems for any persistent malicious presence.
Detection and Response
Developers should audit their package-lock.json or yarn.lock files for the presence of any packages matching the dowload_ebok_ prefix. If any of these packages are found, immediate action is required:
- Rotate all credentials, API keys, and tokens that may have been exposed.
- Review npm token logs for any unauthorized publish events.
- Thoroughly scan and clean affected development and production environments.
Examples of the malicious package names include: dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc dowload_ebok_lolita_by_vladimir_nabokov_oy1gy dowload_ebok_armageddon_by_max_hastings_kv3s4
Broader Context
This incident highlights the ongoing threat of coordinated supply chain attacks targeting package registries. The use of a distinct prefix and a rapid, synchronized disclosure points to an attacker attempting to maximize their reach before detection. The quick identification and removal of these packages demonstrate the effectiveness of security monitoring, but also underscore the need for continuous vigilance against evolving attack methodologies.