Which versions of @nzeros/codebreak are malicious?

The following npm versions of @nzeros/codebreak are flagged malicious: 1.3.0. Treat any of these as compromised.

How do I remediate @nzeros/codebreak if I installed it?

Remove @nzeros/codebreak from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed @nzeros/codebreak — how do I know if it already compromised me?

If @nzeros/codebreak was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @nzeros/codebreak part of a known attack campaign?

Yes — @nzeros/codebreak is associated with the IN-MAL-2026-017370 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @nzeros/codebreak across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @nzeros/codebreak (version 1.3.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @nzeros/codebreak across your stack and pipelines.

Malicious package

@nzeros/codebreaknpm

@nzeros/codebreak is a confirmed malicious npm package (MAL-2026-13736) that executes malicious code on install (malicious version 1.3.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @nzeros/codebreak (npm)

MAL-2026-13736

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @nzeros/codebreak

What this malware does

The package declares native/solver.c as the source of a small C minimax solver and advertises vendor/solver-<platform>-<arch> as its compiled output. The darwin-arm64 slot contains a ~34KB Mach-O consistent with that C source, but vendor/solver-darwin-x64 and vendor/solver-linux-x64 are identical 33,648,788-byte Linux ELF Go binaries (same sha256 05b69666...4420) that link net/http, os/exec, crypto/chacha8, and reference /proc/self/. The postinstall script invokes spawnSync(BINARY, ['selftest']) on install, so on Linux x64 hosts the shipped opaque Go binary runs automatically at install time. The binary's linked packages (network client, process execution, symmetric crypto) and ~1000x size inflation over any plausible build of the declared C algorithm are inconsistent with the documented purpose, and the darwin-x64 slot being populated with a Linux ELF further indicates the vendor tree was not built from the shipped C source. The install-time execution path against unverified, purpose-mismatched bytes on Linux x64 is a fetch-and-execute equivalent embedded in the tarball rather than downloaded, and the destination of any network activity performed by the Go binary cannot be determined from strings alone.

Malicious versions

1 flagged

1.3.0

Indicators of compromise (SHA-256)

cf2d80dd4a014bd04f0f01ef666cc4a6a09bb010a37e572a0eb9a3e0298ed5fe

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @nzeros/codebreak (version 1.3.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @nzeros/codebreak across your stack and pipelines.
If you installed it — respond
Remove @nzeros/codebreak from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @nzeros/codebreak was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @nzeros/codebreak before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @nzeros/codebreak on npm has been identified as a malicious package (version 1.3.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017370

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @nzeros/codebreak-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database