Which versions of @uwr/colors are malicious?

The following npm versions of @uwr/colors are flagged malicious: 1.3.6. Treat any of these as compromised.

How do I remediate @uwr/colors if I installed it?

@uwr/colors is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @uwr/colors — how do I know if it already compromised me?

If @uwr/colors was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is @uwr/colors part of a known attack campaign?

Yes — @uwr/colors is associated with the IN-MAL-2026-009729, RLMA-2026-05478, RLUA-2026-05939 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @uwr/colors across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for @uwr/colors (version 1.3.6).

Malicious package

@uwr/colorsnpm

Advisory published Jul 10, 2026Updated Sep 1, 2026

@uwr/colors is a confirmed malicious npm package (MAL-2026-10179) that steals credentials and exfiltrates sensitive data (malicious version 1.3.6). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @uwr/colors (npm)

MAL-2026-10179

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @uwr/colors

What this malware does

The package's postinstall script reads the installer's machine hostname via os.hostname() and performs a DNS lookup of <hostname>.0ab1mctv5xigbskwtfusp77dj4pvdx1m.oastify.com, leaking the hostname to a Burp Suite Collaborator subdomain at npm install time without consent. oastify.com is the Burp Collaborator service, commonly used by attackers as an out-of-band data-exfiltration channel. The package's advertised functionality is a trivial 5-entry frozen color constants map under the unscoped-looking @uwr scope ("colors for the unified workflow runtime") with an empty author field, consistent with a dependency-confusion / reconnaissance probe staged against an internal namespace rather than a legitimate library.

Malicious versions

1 flagged

1.3.6

Indicators of compromise (SHA-256)

91240d8fb55b7ed4730a41f3a334c633bf1a03afb649fd473cad0c0a25312847

2d76c8b3ef969014ce1aac3570f199229c11877b2d552317f0a30d7e9c7e81d3

efe858157b007dab5e4236a52936db9f3d4fe0997887f5c421702242f917f72d

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for @uwr/colors (version 1.3.6).
If you installed it — respond
@uwr/colors is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @uwr/colors was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @uwr/colors on npm has been identified as a malicious package (version 1.3.6 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009729RLMA-2026-05478RLUA-2026-05939

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks @uwr/colors-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database