@bytemend/mfebusnpm
@bytemend/mfebus is a confirmed malicious npm package (MAL-2026-6213) that executes malicious code on install (malicious versions 1.4.0, 1.4.1, 1.4.2…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @bytemend/mfebus (npm)
What this malware does
The package advertises itself as a small in-memory pubsub library but its main entry dist/index.js eagerly require()s dist/bootstrap.js, a 277KB obfuscator.io-protected blob (string-array rotation, control-flow flattening, RC4 string decoder, self-defending wrappers) whose decoded behavior is a remote-code dropper. On require — and automatically when the module is loaded inside a forked Node child via maybeInstallAutoIpc()/addIpcTarget(process) — the bootstrap: (1) re-spawns process.execPath detached with the original argv and an env-var sentinel as an anti-analysis re-entry guard (child_process.spawn(process.execPath, process.argv.slice(1), { detached:true, windowsHide:true, stdio:'ignore' }) followed by unref()); (2) opens an HTTPS request to a destination resolved from RC4-decrypted strings, follows redirects, and writes the response under os.homedir()/.cache/<dir>/; (3) verifies a SHA-256 against a sidecar metadata file and then require()s the downloaded payload, executing attacker-controlled code in the installer's Node process. Before doing any of this, it installs no-op handlers for uncaughtException, unhandledRejection, and warning and wraps the flow in try/catch with process.exit(0) paths so failures are silently swallowed and never reach host application logs or telemetry. None of this network, child-process, or self-respawn behavior is disclosed in the README, and none of it is consistent with the package's stated pubsub purpose. Any project that imports this package — directly, transitively, or in a forked worker — fetches and executes attacker-controlled code on the installer's machine.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @bytemend/mfebus (6 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @bytemend/mfebus across your stack and pipelines.
If you installed it — respond
Remove @bytemend/mfebus from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @bytemend/mfebus was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @bytemend/mfebus before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @bytemend/mfebus-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.