Which versions of @brick-v2/table are malicious?

The following npm versions of @brick-v2/table are flagged malicious: 999.0.1, 999.0.2, 999.0.3. Treat any of these as compromised.

How do I remediate @brick-v2/table if I installed it?

@brick-v2/table is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @brick-v2/table — how do I know if it already compromised me?

If @brick-v2/table was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is @brick-v2/table part of a known attack campaign?

Yes — @brick-v2/table is associated with the IN-MAL-2026-021289, IN-MAL-2026-021299, IN-MAL-2026-021312 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @brick-v2/table across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for @brick-v2/table (3 malicious versions).

Malicious package

@brick-v2/tablenpm

Advisory published Oct 9, 2026Updated Oct 12, 2026

@brick-v2/table is a confirmed malicious npm package (MAL-2026-17718) that steals credentials and exfiltrates sensitive data (malicious versions 999.0.1, 999.0.2, 999.0.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @brick-v2/table (npm)

MAL-2026-17718

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @brick-v2/table

What this malware does

@brick-v2/table is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii__, targeting the internal @galicia-toolkit-* / @brick-v2 package namespaces with inflated versions (e.g. 999.0.x). Early versions resolve <hostname>.<tag>.dc.oob.s4yhii.com via DNS to beacon the victim's hostname. Later versions run node index.js from a preinstall hook, which loads a bundled native addon (prebuilds/<platform>-<arch>/metrics.node, Linux and Windows builds). The addon forks a detached process that collects hostname, username, OS/arch, cwd and the full values of CI/cloud secrets from environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, SYSTEM_ACCESSTOKEN, AZURE_DEVOPS_EXT_PAT and others) and sends them as JSON via HTTP POST /native to oob.s4yhii.com:9999.

@brick-v2/table presents a trivial Angular-style logger/table shim (forRoot/createLogger/version no-ops) while index.js unconditionally side-loads prebuilds/<platform>-<arch>/metrics.node on require(). The native addon reads credential-shaped environment variables from the installer — AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN — along with hostname, uid, cwd, OS, arch, and release, and POSTs them as JSON over raw HTTP/1.0 to the hardcoded host oob.s4yhii.com at path /native. The native code calls fork+setsid to detach the exfil process so it survives after the host process exits. The destination is not first-party, is not caller-configurable, and the cover-story naming (package name unrelated to behavior, 'metrics.node' filename, _METRICS_PKG env var) disguises the stealer as telemetry. The version number 999.0.2 is implausibly high for the package name, consistent with a dependency-confusion lure.

Malicious versions

3 flagged

999.0.1999.0.2999.0.3

Indicators of compromise (SHA-256)

14cde1c957f1744198b621bbe4f643ebec8ce12715bba3d7b0ac95f4695a7ad3

1fdd2bc5b913543c62603b366fb4e1261407f63541e4b01ff7e0052e522523e0

289c5a11091bb1a39a200214859ff7fd3c8fe3d2824b5ca5d5ea0030ddcace0a

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for @brick-v2/table (3 malicious versions).
If you installed it — respond
@brick-v2/table is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @brick-v2/table was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @brick-v2/table on npm has been identified as a malicious package (versions 999.0.1, 999.0.2, 999.0.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021289IN-MAL-2026-021299IN-MAL-2026-021312

References

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks @brick-v2/table-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database