NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

@iana-rzms/bff-sdknpm

Advisory published Updated

@iana-rzms/bff-sdk is a confirmed malicious npm package (MAL-2026-10403) that executes malicious code on install (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @iana-rzms/bff-sdk (npm)

MAL-2026-10403
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @iana-rzms/bff-sdk

What this malware does

Package published to the public @iana-rzms scope as a dependency-confusion squat targeting an internal ICANN namespace. The preinstall lifecycle script runs automatically on npm install and collects the installer's hostname, OS username, and current working directory, base64-encodes them, and transmits them via HTTPS (port 443), HTTP (port 80), and DNS lookup to the hardcoded external host k4pzh6vg78iub3vxqhmml2q8wz2qqge5.oastify.com (a Burp Collaborator subdomain). The self-described 'authorized PoC' framing in the README does not change installer-side impact: any build that resolves @iana-rzms/bff-sdk from the public registry executes attacker/researcher-controlled code at install time and leaks host identity to a non-first-party collector.

Malicious versions

1 flagged
1.0.0

Indicators of compromise (SHA-256)

b7adbad0c719aec3345c5aa16b3435e8621f4a81b5a0e0cf0e0d979509e5d21f

Detection & response playbook

Malicious package

  1. Find it

    Search your lockfiles and build artifacts for @iana-rzms/bff-sdk (version 1.0.0).

  2. If you installed it — respond

    Remove @iana-rzms/bff-sdk from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

  3. Did it already run?

    If @iana-rzms/bff-sdk was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @iana-rzms/bff-sdk on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009802

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks @iana-rzms/bff-sdk-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@iana-rzms/bff-sdk (npm) malicious package — MAL-2026-10403 | O3 Security