Which versions of @nsub/nitxe are malicious?

The following npm versions of @nsub/nitxe are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate @nsub/nitxe if I installed it?

@nsub/nitxe is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @nsub/nitxe — how do I know if it already compromised me?

If @nsub/nitxe was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @nsub/nitxe part of a known attack campaign?

Yes — @nsub/nitxe is associated with the GHSA-54gp-rw59-mwf2, IN-MAL-2026-010250, IN-MAL-2026-010476 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @nsub/nitxe across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @nsub/nitxe (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @nsub/nitxe across your stack and pipelines.

Malicious package

@nsub/nitxenpm

@nsub/nitxe is a confirmed malicious npm package (MAL-2026-10429) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @nsub/nitxe (npm)

MAL-2026-10429

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @nsub/nitxe

What this malware does

The package's declared npm postinstall script collects the installer's username (os.userInfo().username), hostname (os.hostname()), platform, and the entire process.env object, base64-encodes the JSON, and transmits it as a query parameter in an HTTPS GET to a hardcoded unrelated host (gjsidn.co/collect?d=...). This fires automatically on npm install. The call is dispatched via eval('play(food())') wrapped in a silent try/catch — an obfuscation pattern with no legitimate purpose. In this specific version the postinstall.js file requires only https and never requires os, so the eval'd call throws a ReferenceError that the try/catch swallows and no network I/O actually occurs — but the code shape is unambiguous credential/environment theft and a one-line follow-up publish would make it live. Installer harm surface: full process.env dump on CI machines commonly exports cloud credentials, CI secrets, and npm publish tokens.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

d3269e39ebe4ffb139eba279503d64bceb158c5a822b2238c92dc463c10aedba

b16147b7ac55d6c4cc4e042be73e6d49fc7232e8a03f406fecd034cdd27bf0eb

8636d8d7ecc7a89a7c4990e963ddd940375a892bdd025f5684edfbb55ff396d0

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @nsub/nitxe (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @nsub/nitxe across your stack and pipelines.
If you installed it — respond
@nsub/nitxe is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @nsub/nitxe was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @nsub/nitxe before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @nsub/nitxe on npm has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-54gp-rw59-mwf2IN-MAL-2026-010250IN-MAL-2026-010476

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @nsub/nitxe-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database