Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

@adobesign/as-dev-toolsnpm

Advisory published Updated

@adobesign/as-dev-tools is a confirmed malicious npm package (MAL-2026-6760) that opens a backdoor for remote access (malicious versions 99.9.9, 99.9.10). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @adobesign/as-dev-tools (npm)

MAL-2026-6760
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @adobesign/as-dev-tools

What this malware does

The package's package.json declares a postinstall lifecycle hook that pipes the output of whoami through curl to a hardcoded Burp Collaborator subdomain (o5u9v30a13fddwo3ey623df59wfn3er3.oastify.com). This fires automatically on npm install, leaking the installer's OS username to an attacker-controlled out-of-band callback host. The package is otherwise empty of legitimate content. The combination of the @adobesign scope, an implausible 99.9.9 version, and an out-of-band beacon is the canonical dependency-confusion attack shape: the public package is designed to be resolved in place of an internal Adobe Sign package of the same name, and any build that resolves it will beacon the installer's identity to the attacker.

The OpenSSF Package Analysis project identified '@adobesign/as-dev-tools' @ 99.9.10 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Malicious versions

2 flagged
99.9.999.9.10

Indicators of compromise (SHA-256)

89bc395364731dd31b151f421bf94decd4441180ae9fa8e16ae540015c3bdc51
bc3c9c46e2d893c8ec87ae68a36569c3561b94fdc6ff9954a02d26bbed847ed6
1762a59d0384b9b8ec626aa449b2af6541c8d90ea278009c3d80892efbd7168c
6752e4d30c584cb5ca6f67265c983257c1531aa306b47ec00b43ddae83fe2532

Detection & response playbook

Backdoor / remote access

  1. Find it

    Search your lockfiles and build artifacts for @adobesign/as-dev-tools (2 malicious versions).

  2. If you installed it — respond

    @adobesign/as-dev-tools establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

  3. Did it already run?

    If @adobesign/as-dev-tools was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @adobesign/as-dev-tools on npm has been identified as a malicious package (versions 99.9.9, 99.9.10 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-008101IN-MAL-2026-008107

References

Credits

  • Amazon Inspector · finder
  • OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks @adobesign/as-dev-tools-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@adobesign/as-dev-tools (npm) malicious package — MAL-2026-6760 | O3 Security