Am I affected by Malicious code in skillward (npm)? What should I do?

Question

The npm package skillward contains malicious code.

Affected: skillward 0.1.1, 0.1.2. Fixed in: no fix reported yet. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/mal-2026-18220-skillward

AgentArmor team · Accepted Answer

**Am I affected?**
Affected: skillward 0.1.1, 0.1.2. Fixed in: no fix reported yet.
- Check your version: run `npm ls skillward`. Versions 0.1.1, 0.1.2 of skillward are affected.

**What to do now**
1. Remove the package if it is installed: run `npm uninstall skillward`.
2. Rotate all secrets and keys stored on that computer immediately, from a different computer.
3. Remove the package.
4. Removing the package may not remove all malicious software, because full control may have been given to an outside entity.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- OSV (Open Source Vulnerabilities): https://osv.dev/MAL-2026-18220

Full incident page: https://agentarmorhq.com/incidents/2026/10/mal-2026-18220-skillward

Am I affected by Malicious code in skillward (npm)? What should I do?

1 answer

Add your answer or comment