Which versions of @businessapp-microsites/apis are malicious?

The following npm versions of @businessapp-microsites/apis are flagged malicious: 9999.0.0, 9999.0.1, 9999.0.2. Treat any of these as compromised.

How do I remediate @businessapp-microsites/apis if I installed it?

@businessapp-microsites/apis is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @businessapp-microsites/apis — how do I know if it already compromised me?

If @businessapp-microsites/apis was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @businessapp-microsites/apis part of a known attack campaign?

Yes — @businessapp-microsites/apis is associated with the IN-MAL-2026-007813, IN-MAL-2026-007814, IN-MAL-2026-008126, GHSA-5x2m-5wc4-5j3c campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @businessapp-microsites/apis across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @businessapp-microsites/apis (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @businessapp-microsites/apis across your stack and pipelines.

Malicious package

@businessapp-microsites/apisnpm

Malicious code in @businessapp-microsites/apis (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6696

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @businessapp-microsites/apis

What this malware does

@businessapp-microsites/[email protected] is a dependency-confusion squat against the private scope @businessapp-microsites, published with an implausibly high version (9999.0.2) to outrank any internal registry copy. On npm install, its postinstall.js runs child_process.execSync to collect hostname, whoami, and uname -a / ver, combines this with os.hostname(), os.userInfo(), and CI attribution env vars (GITHUB_REPOSITORY, GITHUB_SHA, RUNNER_NAME, etc.), and sends them via https.get to a hardcoded external callback at poc-trustpilot-npm-1782770591.testingboxes.com. Any org whose internal registry mirrors public npm and resolves this scope will auto-execute the beacon under CI credentials. The package self-labels as a bug-bounty PoC, but the executed code is a full dependency-confusion exfil payload against installers of the squatted scope; cover-story framing does not change the installer-side harm.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

3 flagged

9999.0.09999.0.19999.0.2

Indicators of compromise (SHA-256)

8e03d8a4119cd5d1c143adb4fcdab1625747178082a6d56717e758b513aec4f7

f314f6c735fd7e1f9b226a235d36d50bb13f253d7fc3dfa7ef06d3b52d5f96bc

b70ab5da6865ec94b15097fa84836ab41f39b65a5277974b407c545d8d424c7f

99d9bf41216d926667db3fad15424bf774c930eea925034003811ff05ca4bbca

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @businessapp-microsites/apis (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @businessapp-microsites/apis across your stack and pipelines.
If you installed it — respond
@businessapp-microsites/apis is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @businessapp-microsites/apis was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @businessapp-microsites/apis before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @businessapp-microsites/apis on npm has been identified as a malicious package (versions 9999.0.0, 9999.0.1, 9999.0.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007813IN-MAL-2026-007814IN-MAL-2026-008126GHSA-5x2m-5wc4-5j3c

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @businessapp-microsites/apis-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring