NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

@chahuadev/junk-sweeper-appnpm

Advisory published Updated

@chahuadev/junk-sweeper-app is a confirmed malicious npm package (MAL-2026-3682) that executes malicious code on install (malicious version 2.0.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @chahuadev/junk-sweeper-app (npm)

MAL-2026-3682
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @chahuadev/junk-sweeper-app

What this malware does

The package's postinstall script (package.json line 10: "postinstall": "node install.js") unconditionally fetches a platform-native executable from https://pub-419d22521da042dfb27d1f404b3eb8a6.r2.dev/Junk-Sweeper.exe or /Junk-Sweeper.AppImage, writes it into the package's bin/ directory, and chmods it 0755 on Linux (install.js lines 10, 14-22, 30-67). No SHA-256, signature, or size verification is performed, and HTTP redirects are followed blindly. The package's bin entrypoint (index.js line 32) then spawnSync's the downloaded binary with the user's argv and inherited stdio, giving the bucket owner a persistent, mutable remote-code-execution channel into any installer machine. The hosting domain is an opaque object-storage bucket, not a versioned release artifact from a transparent source (GitHub Releases with tag pinning, npm registry, etc.). Whether or not the current binary contents are malicious, the delivery mechanism allows the content to be swapped at any time without any version change to the npm package.

Malicious versions

1 flagged
2.0.3

Indicators of compromise (SHA-256)

3d446150767f92344d8d0a699f5879bd746200fb8beb60554408699868f03d51

Detection & response playbook

Malicious package

  1. Find it

    Search your lockfiles and build artifacts for @chahuadev/junk-sweeper-app (version 2.0.3).

  2. If you installed it — respond

    Remove @chahuadev/junk-sweeper-app from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

  3. Did it already run?

    If @chahuadev/junk-sweeper-app was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @chahuadev/junk-sweeper-app on npm has been identified as a malicious package (version 2.0.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-002219

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks @chahuadev/junk-sweeper-app-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@chahuadev/junk-sweeper-app (npm) malicious package — MAL-2026-3682 | O3 Security