@sarex-team/viewernpm
@sarex-team/viewer is a confirmed malicious npm package (MAL-2026-14207) that steals credentials and exfiltrates sensitive data (malicious version 9.9.11). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @sarex-team/viewer (npm)
What this malware does
The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basename to the hardcoded attacker-controlled domain oob.sl4x0.xyz. lib/core.js collects os.userInfo().username, os.hostname(), and process.cwd(), joins them as subdomain labels under oob.sl4x0.xyz, and issues a dns.resolve4() lookup so the encoded values are exfiltrated via DNS. The destination domain and the module/API names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4') are reconstructed from numeric char-code arrays in lib/b02e30.js and lib/6ad264.js solely to conceal them. Execution is zero-interaction: package.json declares scripts.install: 'node index.js', and index.js top-level requires./lib/core inside a try/catch that swallows errors, so the beacon fires on npm install and again on every require() of the package while the install appears clean.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Search your lockfiles and build artifacts for @sarex-team/viewer (version 9.9.11).
If you installed it — respond
@sarex-team/viewer is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @sarex-team/viewer was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @sarex-team/viewer-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.