Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

@bx-ui-framework/authenticationnpm

Advisory published Updated

@bx-ui-framework/authentication is a confirmed malicious npm package (MAL-2026-15866) that executes malicious code on install (malicious versions 1.2.0, 15.0.0, 16.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @bx-ui-framework/authentication (npm)

MAL-2026-15866
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @bx-ui-framework/authentication

What this malware does

package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL (https://repo.artifactorymanager.com/bx-ui-framework/authentication) rather than an npm registry version range. On npm install, npm fetches whatever bytes that host returns and installs them as a dependency, running any lifecycle scripts contained in the fetched artifact. There is no version pin, no integrity hash, and no signature check, so the delivered content is fully controlled by whoever operates repo.artifactorymanager.com, and can change between installs. The shipped package itself is a minimal stub, so this manifest entry is effectively the entire installable payload. The dependency key (microfrontend) does not match the package's own name, and the host domain is unrelated to any npm-scope publisher identity for @bx-ui-framework.

Malicious versions

3 flagged
1.2.015.0.016.0.0

Indicators of compromise (SHA-256)

8562942e7b9d79df895b98cbb49f25b83ee812cacd25b48a48eb81c619bbbfaf
a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57
42f0972647de2c53dd2af11def327f594a17d62c5425b63c74a46305556d60dd

Detection & response playbook

Malicious package

  1. Find it

    Search your lockfiles and build artifacts for @bx-ui-framework/authentication (3 malicious versions).

  2. If you installed it — respond

    Remove @bx-ui-framework/authentication from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

  3. Did it already run?

    If @bx-ui-framework/authentication was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @bx-ui-framework/authentication on npm has been identified as a malicious package (versions 1.2.0, 15.0.0, 16.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019406IN-MAL-2026-019405IN-MAL-2026-019646

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks @bx-ui-framework/authentication-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@bx-ui-framework/authentication (npm) malicious package — MAL-2026-15866 | O3 Security