Am I affected by Malware found in the npm package skillward? What should I do?

Question

The npm package skillward contains malware.

Affected: npm/skillward 0.1.1 and 0.1.2. Fixed in: no fix reported yet. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/ghsa-9wgc-5pgr-25p3-skillward

AgentArmorHQ team · Accepted Answer

**Am I affected?**
Affected: npm/skillward 0.1.1 and 0.1.2. Fixed in: no fix reported yet.
- Check your version: run `npm ls skillward`. Versions = 0.1.1 of skillward are affected.

**What to do now**
1. Remove the package if it is installed: run `npm uninstall skillward`.
2. Rotate all secrets and keys stored on the computer immediately, from a different computer.
3. Remove the package.
4. Removing the package may not remove all malicious software that came from installing it.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- GitHub Advisory Database: https://github.com/advisories/GHSA-9wgc-5pgr-25p3

Full incident page: https://agentarmorhq.com/incidents/2026/10/ghsa-9wgc-5pgr-25p3-skillward

Am I affected by Malware found in the npm package skillward? What should I do?

1 answer

Add your answer or comment