Which versions of @adminhub-page/emails are malicious?

The following npm versions of @adminhub-page/emails are flagged malicious: 1.0.0, 18.0.0. Treat any of these as compromised.

How do I remediate @adminhub-page/emails if I installed it?

Remove @adminhub-page/emails from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed @adminhub-page/emails — how do I know if it already compromised me?

If @adminhub-page/emails was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is @adminhub-page/emails part of a known attack campaign?

Yes — @adminhub-page/emails is associated with the RLMA-2024-00005, RLUA-2024-05857, RLUA-2026-05792 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @adminhub-page/emails across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for @adminhub-page/emails (2 malicious versions).

Malicious package

@adminhub-page/emailsnpm

Advisory published Jun 25, 2024Updated Sep 1, 2026

@adminhub-page/emails is a confirmed malicious npm package (MAL-2024-2291) that executes malicious code on install (malicious versions 1.0.0, 18.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @adminhub-page/emails (npm)

MAL-2024-2291

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @adminhub-page/emails

Malicious versions

2 flagged

1.0.018.0.0

Indicators of compromise (SHA-256)

278bce71c6c2c0a11c4f281a6585e7521e9c2ef9776eea51bad139c568c07e94

67c0ec8843e3456a2cad3c94052876dcc78689d45141c452985c1c1fb403b70c

6aa17701bfedab89c8936e3d2f680be6bcd65b0f492164dbc4a91cc06e1c6223

f646b808377d13c2a86ac282f1d4c422a067e778fd014e0d96d07c2b745b9224

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for @adminhub-page/emails (2 malicious versions).
If you installed it — respond
Remove @adminhub-page/emails from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @adminhub-page/emails was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @adminhub-page/emails on npm has been identified as a malicious package (versions 1.0.0, 18.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-00005RLUA-2024-05857RLUA-2026-05792

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks @adminhub-page/emails-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database