What does the @monitoring-lib/error-tracking malware do?

On `npm install`, the `preinstall` lifecycle hook in package.json runs a Node one-liner that reads the installer's hostname (`os.hostname()`) and username (`os.userInfo().username`) and transmits them to an attacker-controlled Interactsh/OAST callback domain via two channels: an HTTPS GET request to `https://d8ks495t5p5ut2enft8041g7fusnfsy5e.oast.site/?h= &u= ` and a DNS lookup of `monitoring-lib. .d8ks495t5p5ut2enft8041g7fusnfsy5e.oast.site`. The package name uses a generic scope (`@monitoring-lib`) that does not correspond to a known publisher, and the version number `9999.0.0` is the canonical shape of a dependency-confusion attack — a public registry upload des

Which versions of @monitoring-lib/error-tracking are malicious?

The following npm versions of @monitoring-lib/error-tracking are flagged malicious: 9999.0.0. Treat any of these as compromised.

How do I remediate @monitoring-lib/error-tracking if I installed it?

Remove @monitoring-lib/error-tracking from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound network activity or persistence. Use O3 Security's dependency scanner to confirm the package and its artifacts are fully purged across your stack.

Is @monitoring-lib/error-tracking part of a known attack campaign?

Yes — @monitoring-lib/error-tracking is associated with the IN-MAL-2026-005362, IN-MAL-2026-005363 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

Can O3 Security detect @monitoring-lib/error-tracking in my codebase?

Yes. O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, blocking @monitoring-lib/error-tracking and packages like it before any post-install script runs.

Malicious package

@monitoring-lib/error-trackingnpm

Malicious code in @monitoring-lib/error-tracking (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5540

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @monitoring-lib/error-tracking

What this malware does

On npm install, the preinstall lifecycle hook in package.json runs a Node one-liner that reads the installer's hostname (os.hostname()) and username (os.userInfo().username) and transmits them to an attacker-controlled Interactsh/OAST callback domain via two channels: an HTTPS GET request to https://d8ks495t5p5ut2enft8041g7fusnfsy5e.oast.site/?h=<hostname>&u=<username> and a DNS lookup of monitoring-lib.<hostname>.d8ks495t5p5ut2enft8041g7fusnfsy5e.oast.site. The package name uses a generic scope (@monitoring-lib) that does not correspond to a known publisher, and the version number 9999.0.0 is the canonical shape of a dependency-confusion attack — a public registry upload designed to override an organization's internal package of the same name. Combined, the package is a supply-chain recon beacon: any installer that resolves to this version leaks its host identity to the attacker, identifying victims whose private-registry configurations failed.

The OpenSSF Package Analysis project identified '@monitoring-lib/error-tracking' @ 9999.0.0 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

1 flagged

9999.0.0

Indicators of compromise (SHA-256)

491603ad44ed812c3d248696b00f7d4801a4c1dc23e4f23a3bb86f2ef499616d

8100d54eed6cb854340b403b4d22c6b2c4a6abc7780fc1a94c00e1d4a5404625

160b44403dfdcc6f9b6a3390ac9d1a2a55ed88c8a3cfd660850d573a89682453

Frequently asked questions

No. @monitoring-lib/error-tracking on npm has been identified as a malicious package (version 9999.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005362IN-MAL-2026-005363

References

npmjs.com

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Scan your dependencies

O3 Security blocks malicious packages like this at install time and in CI.

Supply-chain protection