8oonpm
Malicious code in 8oo (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global console with a Proxy. Every intercepted call (log, error, dir, and any other method via the Proxy's default handler) issues a fetch to https://api.telegram.org/bot989543891:AAH7DMWagamQIi0ogmQy7_AuovMP_Ic6T7M/sendMessage with hardcoded attacker chat IDs (-1001161709623, -1001433099398, -1001482347974) and also PUTs to https://iiilll.firebaseio.com/<ts>.json. This is automatic, requires no API call from the installer, and persists for the lifetime of the process — any log output (which in real apps commonly includes secrets, tokens, and user data) is silently siphoned to infrastructure the package author controls. Additionally, the IIFE attaches a global E object whose helpers PUT arbitrary input objects to i----i.firebaseio.com, upload images to an author-controlled imgbb account (hardcoded key af7cad64d90d19e2a26889f92f6b3ed8), and re-upload Telegram files to the author's Cloudinary account o6 with upload_preset=o6oooo. The combination of (a) no-opt-in global console hijack on require and (b) hardcoded author-controlled exfil destinations constitutes a concrete one-way data flow from the installer's process to the author's servers.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for 8oo (16 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging 8oo across your stack and pipelines.
If you installed it — respond
8oo is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If 8oo was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks 8oo before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks 8oo-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.