Which versions of @sentry-internal-sdk/profiling-node are malicious?

The following npm versions of @sentry-internal-sdk/profiling-node are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate @sentry-internal-sdk/profiling-node if I installed it?

Remove @sentry-internal-sdk/profiling-node from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound network activity or persistence. Use O3 Security's dependency scanner to confirm the package and its artifacts are fully purged across your stack.

Is @sentry-internal-sdk/profiling-node part of a known attack campaign?

Yes — @sentry-internal-sdk/profiling-node is associated with the IN-MAL-2026-005475, IN-MAL-2026-005476, IN-MAL-2026-005477, IN-MAL-2026-005478 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

Can O3 Security detect @sentry-internal-sdk/profiling-node in my codebase?

Yes. O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, blocking @sentry-internal-sdk/profiling-node and packages like it before any post-install script runs.

Malicious package

@sentry-internal-sdk/profiling-nodenpm

Malicious code in @sentry-internal-sdk/profiling-node (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5563

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @sentry-internal-sdk/profiling-node

What this malware does

Package name @sentry-internal-sdk/profiling-node impersonates the legitimate @sentry/profiling-node (Sentry publishes under the @sentry org; no @sentry-internal-sdk org exists). The shipped cli.js is a credential-harvesting tool wearing a Sentry-SDK cover story.

On default npx invocation, cli.js clones the entire process.env via Object.assign({}, process.env) (line 67) and POSTs it together with os.userInfo(), os.hostname(), cwd, and ppid to https://advisory-tracker.com/api/v1/telemetry. This leaks every secret in the developer's environment, including AWS_*, GITHUB_TOKEN, NPM_TOKEN, ANTHROPIC_API_KEY, and any other tokens the shell carries.

A second pass (getBuildEnvironment, cli.js:230-238) probes a fixed list of installer credential files — ~/.npmrc, ~/.docker/config.json, ~/.kube/config, ~/.aws/config, ~/.gitconfig, ~/.config/gh/hosts.yml, ~/.netrc — and reports their presence and size, then walks up three parent directories collecting .env files, git remote URLs, configured git user.email, the last five commit messages, parent-process cmdline, project package.json metadata, and full os.networkInterfaces(), all shipped to the same attacker endpoint.

getRuntime (cli.js:58-63) fingerprints AI coding agents by inspecting env vars such as CLAUDE_CODE, ANTHROPIC_API_KEY, CLAUDE_SESSION_KEY, CURSOR_*, GITHUB_COPILOT, COPILOT_AGENT, WINDSURF_*, CODEIUM_API_KEY, and VSCODE_* — indicating the campaign targets AI-assisted developer environments where agents may auto-npx packages. Outbound requests carry a fake X-Tenet-Security: ResponsibleDisclosure [SECURITY SCAN] header and inline comments frame the exfiltration as 'platform compatibility tracking' and 'distributed tracing correlation' to evade reviewer and DLP inspection.

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

7ba8bb0fdef753e0b8ab4c1952d4b0ec3579dc23e487c2be10fbfb9dcfed6e8d

8c0a439cc32d2b21ab9d9eb3e4b809306d3e118f9fa6e5ee30a41a31f93e7e6a

c7951165844874f57819b0d63b8c8511e4e9217bf0f9231ec02f06cb6e059c47

de07f8c8ce67b8d68c5e74c91f4ab73631b12d617535df14447690a33bc21f45

Frequently asked questions

No. @sentry-internal-sdk/profiling-node on npm has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005475IN-MAL-2026-005476IN-MAL-2026-005477IN-MAL-2026-005478

References

Credits

Amazon Inspector · finder

Scan your dependencies

O3 Security blocks malicious packages like this at install time and in CI.

Supply-chain protection