Which versions of @public-for-cdao/token are malicious?

The following npm versions of @public-for-cdao/token are flagged malicious: 99.99.99. Treat any of these as compromised.

How do I remediate @public-for-cdao/token if I installed it?

@public-for-cdao/token is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @public-for-cdao/token — how do I know if it already compromised me?

If @public-for-cdao/token was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is @public-for-cdao/token part of a known attack campaign?

Yes — @public-for-cdao/token is associated with the IN-MAL-2026-010547, RLMA-2026-05456, RLUA-2026-05912 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @public-for-cdao/token across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for @public-for-cdao/token (version 99.99.99).

Part of a larger attack: @public-for-cdao published 15 malicious packages. See the full campaign →

Malicious package

@public-for-cdao/tokennpm

Advisory published Jun 17, 2026Updated Sep 1, 2026

@public-for-cdao/token is a confirmed malicious npm package (MAL-2026-10603) that steals credentials and exfiltrates sensitive data (malicious version 99.99.99). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @public-for-cdao/token (npm)

MAL-2026-10603

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @public-for-cdao/token

What this malware does

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has SHA-256 3dd1f7827fe311d17f442e0af0fab46f3f1a938bb3409838536795fb1aa0f740.

The script collects CI tokens, GitLab access tokens, SSH and deployment keys, AWS credentials, database and Redis passwords, private keys, cryptocurrency mnemonics and seed phrases, Docker and npm credentials, and Slack and Discord tokens from environment variables. It also searches common project, application, root, and CI-runner locations for .env files and extracts lines containing KEY, SECRET, TOKEN, PASS, PRIVATE, or MNEMONIC. The package name, version, hostname, and collected secrets are POSTed to a fixed webhook.site endpoint and a Pipedream endpoint with TLS certificate verification disabled.

Package @public-for-cdao/[email protected] is a dependency-confusion payload targeting an internal @cdao/token scope. package.json declares a postinstall hook that runs node recon.js, which on npm install collects host identity (os.hostname(), username, platform, cwd), iterates a large list of CI/CD and cloud credential environment variables (including AWS_SECRET_ACCESS_KEY, NPM_TOKEN, GITLAB_* tokens, PRIVATE_KEY, MNEMONIC, DB_PASSWORD), reads .env* files at multiple paths and greps for KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC lines, and enumerates GitLab-runner build directories under /builds/, /home/gitlab-runner/builds/, and /var/lib/gitlab-runner/. The collected data is JSON-serialized and POSTed over HTTPS with rejectUnauthorized:false to two attacker-controlled endpoints: webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd and enqoojbegdvxj.x.pipedream.net. The version 99.99.99 and mismatched public scope are consistent with attempting to preempt resolution of an internal package of the same base name.

Malicious versions

1 flagged

99.99.99

Indicators of compromise (SHA-256)

eb59d96acba76c5d5e2044eae3d7dfeb33bc19f10d75aa04fcf6765ad9b7fde8

76a2e9717ce97919246ae14ddfabb2fb2daade052684ea92e43114ad523ba6f1

a120bf7d609666db32a16471151818a1afc0e3fa87b1adffef45fc2c0fe5c046

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for @public-for-cdao/token (version 99.99.99).
If you installed it — respond
@public-for-cdao/token is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @public-for-cdao/token was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @public-for-cdao/token on npm has been identified as a malicious package (version 99.99.99 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010547RLMA-2026-05456RLUA-2026-05912

References

Credits

Amazon Inspector · finder
ReversingLabs · finder
YoSheep · finder

Detect & block this

O3 blocks @public-for-cdao/token-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database