Which versions of @businessapp-microsites/apis are malicious?

The following npm versions of @businessapp-microsites/apis are flagged malicious: 9999.0.0, 9999.0.1. Treat any of these as compromised.

How do I remediate @businessapp-microsites/apis if I installed it?

@businessapp-microsites/apis is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @businessapp-microsites/apis — how do I know if it already compromised me?

If @businessapp-microsites/apis was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @businessapp-microsites/apis part of a known attack campaign?

Yes — @businessapp-microsites/apis is associated with the IN-MAL-2026-007813, IN-MAL-2026-007814 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @businessapp-microsites/apis across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @businessapp-microsites/apis (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @businessapp-microsites/apis across your stack and pipelines.

Malicious package

@businessapp-microsites/apisnpm

Malicious code in @businessapp-microsites/apis (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6696

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @businessapp-microsites/apis

What this malware does

Package squats the @businessapp-microsites npm scope and is published at version 9999.0.0 to outrank any internal version during dependency resolution. The package.json declares a postinstall script that runs node -e to issue an HTTPS GET to poc-trustpilot-npm-1782770591.testingboxes.com with a unique per-package token in the URL path. On any npm install that resolves this scope from the public registry, the installer's machine performs an outbound callback that confirms execution and discloses the installer's source IP and the fact-of-install to a third-party host. The combination of an unregistered-scope squat, the 9999.0.0 version pin, and an install-time beacon to an external host is the canonical dependency-confusion attack pattern; researcher framing in the package metadata does not change the runtime behavior on any machine that installs it.

Malicious versions

2 flagged

9999.0.09999.0.1

Indicators of compromise (SHA-256)

8e03d8a4119cd5d1c143adb4fcdab1625747178082a6d56717e758b513aec4f7

f314f6c735fd7e1f9b226a235d36d50bb13f253d7fc3dfa7ef06d3b52d5f96bc

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @businessapp-microsites/apis (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @businessapp-microsites/apis across your stack and pipelines.
If you installed it — respond
@businessapp-microsites/apis is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @businessapp-microsites/apis was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @businessapp-microsites/apis before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @businessapp-microsites/apis on npm has been identified as a malicious package (versions 9999.0.0, 9999.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007813IN-MAL-2026-007814

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @businessapp-microsites/apis-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring