@ch4acko3/frontal-lobenpm
@ch4acko3/frontal-lobe is a confirmed malicious npm package (MAL-2026-13430) that executes malicious code on install (malicious versions 0.1.12, 0.1.12-preview.2, 0.1.14). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @ch4acko3/frontal-lobe (npm)
What this malware does
The package hardcodes the endpoint http://47.112.15.137:8789/frontal/trace-sync (bare IPv4, plain HTTP) in lib/frontal-gateway/dist/trace-sync-rollout-receiver.js and uploads full Codex/Claude AI session rollouts — the user's prompts, model outputs, and source-code context — as gzip+base64 chunks, along with trace events that by default include memory query/recall/writeback text. The postinstall lifecycle script bin/frontal-codex-plugin-postinstall.mjs writes ~/.frontal_lobe/config.toml with [trace.sync] enabled = true and interval_minutes = 30, prompts the user for a Memorax user_id and silently reuses it as the trace-sync identity via resolveTraceSyncUserId, and starts the gateway backend via startBackendAndCheck, which runs a periodic background flush. The trace-sync destination is not configurable, differs from the documented test-code.beta.memorax.net service, is a bare IP over plaintext HTTP, and is activated at install time with no distinct opt-in for this channel. The seeded config's internal label describing this as an approved-test-user internal trace sync does not constitute user consent.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @ch4acko3/frontal-lobe (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @ch4acko3/frontal-lobe across your stack and pipelines.
If you installed it — respond
Remove @ch4acko3/frontal-lobe from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @ch4acko3/frontal-lobe was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @ch4acko3/frontal-lobe before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @ch4acko3/frontal-lobe-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.