Which versions of @epic-common/observability-node are malicious?

The following npm versions of @epic-common/observability-node are flagged malicious: 10.10.1, 10.10.2. Treat any of these as compromised.

How do I remediate @epic-common/observability-node if I installed it?

@epic-common/observability-node is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @epic-common/observability-node — how do I know if it already compromised me?

If @epic-common/observability-node was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @epic-common/observability-node part of a known attack campaign?

Yes — @epic-common/observability-node is associated with the IN-MAL-2026-007721, IN-MAL-2026-007722 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @epic-common/observability-node across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @epic-common/observability-node (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @epic-common/observability-node across your stack and pipelines.

Malicious package

@epic-common/observability-nodenpm

Malicious code in @epic-common/observability-node (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6562

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @epic-common/observability-node

What this malware does

Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-confusion vehicle. On import of the./api subpath, top-level code enumerates all process.env keys and POSTs the full key list, hostname, cwd, platform, and arch to https://otel-collector.ramanmgg1.workers.dev/da32b89f213c91a0. For every env var whose name matches a credential-shaped pattern (TOKEN|SECRET|KEY|PASSWORD|AUTH|AWS|GCP|AZURE|DATABASE|REDIS|MONGO|STRIPE|JWT|SESSION|COOKIE|WEBHOOK|...), it additionally transmits the variable name, value length, first 2 characters, and SHA-256 of the value. The name+length+prefix+hash tuple enables offline brute-force/dictionary recovery of low-entropy or fixed-format secrets (e.g., AWS access keys). The package re-exports the real OpenTelemetry API so dependent builds appear functional, masking the exfiltration. Any installer or build pipeline whose resolver pulls @epic-common/observability-node from the public registry instead of an internal one will execute this beacon on import. Self-described as a security-research PoC, but the README/intent self-label does not change the installer-side harm: env-var inventory, host identifiers, and credential fingerprints leave the installer's machine to a non-first-party endpoint without consent.

Malicious versions

2 flagged

10.10.110.10.2

Indicators of compromise (SHA-256)

73d7457ccefffe2de1f0464f21ac2eadfb981be593d2b34ceb0d5cde1174da0b

dec788bdcb2fa3098e1493c67e5b6e8a83f5495046e6cd3cf90fc654437fe221

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @epic-common/observability-node (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @epic-common/observability-node across your stack and pipelines.
If you installed it — respond
@epic-common/observability-node is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @epic-common/observability-node was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @epic-common/observability-node before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @epic-common/observability-node on npm has been identified as a malicious package (versions 10.10.1, 10.10.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007721IN-MAL-2026-007722

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @epic-common/observability-node-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring