Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

@securihackbot/depconf-stage-1792484738npm

Advisory published Updated

@securihackbot/depconf-stage-1792484738 is a confirmed malicious npm package (MAL-2026-18105) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @securihackbot/depconf-stage-1792484738 (npm)

MAL-2026-18105
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @securihackbot/depconf-stage-1792484738

What this malware does

The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It collects os.hostname(), the local username, platform/arch, Node version, package name, and a nonce, base64-encodes the payload, and sends it as a d= query parameter via plain-HTTP GET to http://34.143.131.27:18080/x-VA-1/main.js (overridable only via a DEPCONF_CALLBACK_URL env var that defaults to this hardcoded bare IP). A DNS beacon fallback to a configurable collaborator suffix is also issued. The package name (@securihackbot/depconf-stage-...) and bundled configure.sh workflow are structured to be re-published under victim-internal scopes so that npm install of an internal package name resolves to this artifact from the public registry, at which point the postinstall beacon fires and leaks the host, user, and internal package name back to the operator — a dependency-confusion attack payload against any environment that resolves it.

Malicious versions

1 flagged
1.0.0

Indicators of compromise (SHA-256)

d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for @securihackbot/depconf-stage-1792484738 (version 1.0.0).

  2. If you installed it — respond

    @securihackbot/depconf-stage-1792484738 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If @securihackbot/depconf-stage-1792484738 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @securihackbot/depconf-stage-1792484738 on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021549

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks @securihackbot/depconf-stage-1792484738-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@securihackbot/depconf-stage-1792484738 (npm) malicious package — MAL-2026-18105 | O3 Security