Which versions of @emcd-vue/b2b-pay-form are malicious?

The following npm versions of @emcd-vue/b2b-pay-form are flagged malicious: 5.7.4. Treat any of these as compromised.

How do I remediate @emcd-vue/b2b-pay-form if I installed it?

@emcd-vue/b2b-pay-form establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed @emcd-vue/b2b-pay-form — how do I know if it already compromised me?

If @emcd-vue/b2b-pay-form was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @emcd-vue/b2b-pay-form part of a known attack campaign?

Yes — @emcd-vue/b2b-pay-form is associated with the IN-MAL-2026-006150, IN-MAL-2026-006149 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @emcd-vue/b2b-pay-form across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @emcd-vue/b2b-pay-form (version 5.7.4). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @emcd-vue/b2b-pay-form across your stack and pipelines.

Malicious package

@emcd-vue/b2b-pay-formnpm

Malicious code in @emcd-vue/b2b-pay-form (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5164

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @emcd-vue/b2b-pay-form

What this malware does

Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the @emcd-vue npm scope to distribute multiple malicious packages posing as internal tooling under the "EMCD Platform Engineering" identity. This package was published on the same day as confirmed campaign packages @emcd-vue/auth and @emcd-vue/loans, which share C2 infrastructure at oob.moika.tech.

The package description ("Internal HTTP client with retry, auth injection and request tracing") is fabricated; the @emcd-vue scope has no affiliation with the real EMCD exchange (emcd.io). Campaign packages in this scope use a multi-stage postinstall dropper that downloads and executes a platform-specific payload from https://oob.moika.tech/payload/{platform} using a shared secret key, writes the payload to a hidden dot-file in the user's home directory, and beacons installation metadata to https://oob.moika.tech/report.

@emcd-vue/b2b-pay-form ships an obfuscator.io-encoded scripts/postinstall.js wired as the npm postinstall lifecycle hook. On npm install, the script builds a platform-keyed URL from os.platform(), performs an HTTPS GET of a remote payload, writes it to os.tmpdir(), and spawns it via spawn(process.execPath, [tmpFile], {detached:true}).unref() — a classic install-time dropper that grants the publisher arbitrary remote code execution on every installing host. An environment-variable kill switch and a TTL-gated JSON cache in the user home directory throttle re-execution to evade detection. The package's stated purpose is an 'Internal HTTP client'; fetching and executing remote Node code is unrelated to that purpose. The package metadata is also fabricated dependency-confusion bait: scope @emcd-vue and all referenced domains (emcd-vue.io, github.emcd-vue.io, jira.emcd-vue.io, docs.emcd-vue.io, npm.emcd-vue.io, telemetry.emcd-vue.io) are not owned by any public organization, and the README instructs consumers to point npm at https://npm.emcd-vue.io while branding the package as 'Internal package — Platform Engineering Team' — the canonical pattern for targeting orgs whose private internal scope matches @emcd-vue or whose CI lazily resolves unknown scopes from the public registry. The postinstall file itself is heavily obfuscated (string-array + RC4-style decoder, control-flow flattening, self-defending function, 109-entry encoded string table), which has no legitimate purpose for a lifecycle script and is consistent with evasion of review.

Malicious versions

1 flagged

5.7.4

Indicators of compromise (SHA-256)

a7ba596c8dca7145a8e505cdb4cf2c96dd1a4e741ea55192e076da181ecc6d38

e45e677cee670117b0ff7dcdf2f04491cfb61385025a178e197ea35924e9410e

Detection & response playbook

Backdoor / remote access

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @emcd-vue/b2b-pay-form (version 5.7.4). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @emcd-vue/b2b-pay-form across your stack and pipelines.
If you installed it — respond
@emcd-vue/b2b-pay-form establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If @emcd-vue/b2b-pay-form was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @emcd-vue/b2b-pay-form before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @emcd-vue/b2b-pay-form on npm has been identified as a malicious package (version 5.7.4 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-006150IN-MAL-2026-006149

References

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks @emcd-vue/b2b-pay-form-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring