Which versions of @gleamkit/ws are malicious?

The following npm versions of @gleamkit/ws are flagged malicious: 8.21.3. Treat any of these as compromised.

How do I remediate @gleamkit/ws if I installed it?

@gleamkit/ws is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @gleamkit/ws — how do I know if it already compromised me?

If @gleamkit/ws was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @gleamkit/ws part of a known attack campaign?

Yes — @gleamkit/ws is associated with the IN-MAL-2026-009803 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @gleamkit/ws across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @gleamkit/ws (version 8.21.3). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @gleamkit/ws across your stack and pipelines.

Malicious package

@gleamkit/wsnpm

Malicious code in @gleamkit/ws (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10402

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @gleamkit/ws

What this malware does

The package publishes under scope @gleamkit/ws while copying the ws package's description, homepage, repository, author, and README verbatim, and bundling the legitimate ws source so it appears functional. Appended to lib/websocket.js after the copied WebSocket implementation is a heavily obfuscated payload (base64+RC4 string decoder over a ~700-entry rotated string array, hex-named identifiers, duplicated as two sequential IIFEs) that reconstructs hostnames, paths, environment keys, and spawn arguments at runtime. On every load — index.js (main) and wrapper.mjs both pull in ./lib/websocket — the payload issues an HTTPS request to fetch an external binary, AES-256-GCM decrypts it, writes it under os.tmpdir(), chmods it to 0o755, and spawns it as a detached, unref()ed child process with windowsHide:true, then calls process.exit. A marker env variable gate (process.env[d]!== e) is used to avoid re-entry. Because require/import is the trigger, any project that installs and loads @gleamkit/ws executes attacker-controlled bytes fetched from a remote host at load time.

Malicious versions

1 flagged

8.21.3

Indicators of compromise (SHA-256)

8fc9213fe9e786988b3fd882b571f03aeaa1487b8006badb837b4e804da66eee

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @gleamkit/ws (version 8.21.3). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @gleamkit/ws across your stack and pipelines.
If you installed it — respond
@gleamkit/ws is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @gleamkit/ws was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @gleamkit/ws before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @gleamkit/ws on npm has been identified as a malicious package (version 8.21.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009803

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @gleamkit/ws-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring