Which versions of @ibrahim1337/baksen are malicious?

The following npm versions of @ibrahim1337/baksen are flagged malicious: 1.5.0, 2.0.0, 2.0.1, 2.0.3. Treat any of these as compromised.

How do I remediate @ibrahim1337/baksen if I installed it?

@ibrahim1337/baksen is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @ibrahim1337/baksen — how do I know if it already compromised me?

If @ibrahim1337/baksen was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @ibrahim1337/baksen part of a known attack campaign?

Yes — @ibrahim1337/baksen is associated with the IN-MAL-2026-007737, IN-MAL-2026-007740, IN-MAL-2026-007739, IN-MAL-2026-007738 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @ibrahim1337/baksen across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @ibrahim1337/baksen (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @ibrahim1337/baksen across your stack and pipelines.

Malicious package

@ibrahim1337/baksennpm

Malicious code in @ibrahim1337/baksen (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6575

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @ibrahim1337/baksen

What this malware does

Package @ibrahim1337/[email protected] is a Windows x64 browser credential stealer. The entry point loads bytenode and executes the V8-bytecode-compiled index.jsc, which detects installed Chromium-family browsers (Chrome, Brave, Edge), terminates the browser processes via taskkill /F /IM to release database locks, reads each browser's Local State to extract the app_bound_encrypted_key, then invokes a shipped native Windows addon at build/Release/debugelevator.node to perform an App-Bound Encryption bypass via a debug session against the browser process. The decrypted master key is then used to read each browser profile's Cookies and Login Data SQLite databases (SELECT encrypted_value FROM cookies, SELECT origin_url, username_value, password_value FROM logins) and write cleartext cookies and saved passwords to local _cookies/ and _passwords/ directories. The package ships no C/C++ source and no binding.gyp — the 676 KB prebuilt .node binary exists solely to defeat Chromium App-Bound Encryption. A companion src/license.jsc is js-confuser obfuscated (numeric string-array, control-flow flattening, base64 decoders) and constructs a remote license-check URL, further hiding behavior from source review. The package has no README, repository is a placeholder (yourusername), and the description is just baksen — cover-story metadata for a credential-theft toolkit. Installing and running this package on Windows results in theft of the developer's browser cookies (live session tokens) and saved website passwords.

Malicious versions

4 flagged

1.5.02.0.02.0.12.0.3

Indicators of compromise (SHA-256)

2f30b699682dfdb02ea4c678ae852f449ee33f3aff57b44206a52387fdacf996

3594b83aa12e5ab4985211494b6b6f73f6def91aae1210e0ae55f28e572d79a8

3c70e5ca03f88c3002eb0d2dcb4bd54dd235b13e91565d112deb4fa370181010

491ac4df82e71d23eb5184150e9890b8aaaf00183be840b75e14ec1c6ff986a3

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @ibrahim1337/baksen (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @ibrahim1337/baksen across your stack and pipelines.
If you installed it — respond
@ibrahim1337/baksen is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @ibrahim1337/baksen was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @ibrahim1337/baksen before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @ibrahim1337/baksen on npm has been identified as a malicious package (versions 1.5.0, 2.0.0, 2.0.1, 2.0.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007737IN-MAL-2026-007740IN-MAL-2026-007739IN-MAL-2026-007738

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @ibrahim1337/baksen-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring