NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

@epic-common/observability-nodenpm

Advisory published Updated

@epic-common/observability-node is a confirmed malicious npm package (MAL-2026-6562) that steals credentials and exfiltrates sensitive data (malicious versions 0.0.1, 0.0.1-security, 10.10.1…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @epic-common/observability-node (npm)

MAL-2026-6562
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @epic-common/observability-node

What this malware does

Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-confusion vehicle. On import of the./api subpath, top-level code enumerates all process.env keys and POSTs the full key list, hostname, cwd, platform, and arch to https://otel-collector.ramanmgg1.workers.dev/da32b89f213c91a0. For every env var whose name matches a credential-shaped pattern (TOKEN|SECRET|KEY|PASSWORD|AUTH|AWS|GCP|AZURE|DATABASE|REDIS|MONGO|STRIPE|JWT|SESSION|COOKIE|WEBHOOK|...), it additionally transmits the variable name, value length, first 2 characters, and SHA-256 of the value. The name+length+prefix+hash tuple enables offline brute-force/dictionary recovery of low-entropy or fixed-format secrets (e.g., AWS access keys). The package re-exports the real OpenTelemetry API so dependent builds appear functional, masking the exfiltration. Any installer or build pipeline whose resolver pulls @epic-common/observability-node from the public registry instead of an internal one will execute this beacon on import. Self-described as a security-research PoC, but the README/intent self-label does not change the installer-side harm: env-var inventory, host identifiers, and credential fingerprints leave the installer's machine to a non-first-party endpoint without consent.

Malicious versions

4 flagged
0.0.10.0.1-security10.10.110.10.2

Indicators of compromise (SHA-256)

73d7457ccefffe2de1f0464f21ac2eadfb981be593d2b34ceb0d5cde1174da0b
dec788bdcb2fa3098e1493c67e5b6e8a83f5495046e6cd3cf90fc654437fe221
0f4a1e914881fb1693afbb25516bd91b8b76e78694c5595e44baaa4229c7b507

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for @epic-common/observability-node (4 malicious versions).

  2. If you installed it — respond

    @epic-common/observability-node is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If @epic-common/observability-node was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @epic-common/observability-node on npm has been identified as a malicious package (versions 0.0.1, 0.0.1-security, 10.10.1, 10.10.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007721IN-MAL-2026-007722IN-MAL-2026-008145

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks @epic-common/observability-node-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@epic-common/observability-node (npm) malicious package — MAL-2026-6562 | O3 Security