Which versions of @sflyinc-knapsack/shutterfly-react are malicious?

The following npm versions of @sflyinc-knapsack/shutterfly-react are flagged malicious: 999.0.0. Treat any of these as compromised.

How do I remediate @sflyinc-knapsack/shutterfly-react if I installed it?

Remove @sflyinc-knapsack/shutterfly-react from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound network activity or persistence. Use O3 Security's dependency scanner to confirm the package and its artifacts are fully purged across your stack.

Is @sflyinc-knapsack/shutterfly-react part of a known attack campaign?

Yes — @sflyinc-knapsack/shutterfly-react is associated with the IN-MAL-2026-004964, IN-MAL-2026-004963 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

Can O3 Security detect @sflyinc-knapsack/shutterfly-react in my codebase?

Yes. O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, blocking @sflyinc-knapsack/shutterfly-react and packages like it before any post-install script runs.

Malicious package

@sflyinc-knapsack/shutterfly-reactnpm

Malicious code in @sflyinc-knapsack/shutterfly-react (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5393

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @sflyinc-knapsack/shutterfly-react

What this malware does

On require/load, index.js collects host identifiers (os.hostname(), os.userInfo(), os.homedir()), DNS server configuration, package.json metadata, and __dirname, then HTTPS-POSTs them to nlc574f24tq03k423v3jr7hllcr3ft3i.oastify.com — a Burp Collaborator (OAST) subdomain. The package is published at version 999.0.0 under a scope mimicking an internal Shutterfly namespace, designed to win npm version resolution against the legitimate private package. Any installer who imports this package leaks host and internal-package metadata to an attacker-controlled endpoint. The package's own description self-identifies as a dependency-confusion proof-of-concept, but the live registry artifact still executes against any consumer that resolves it.

Malicious versions

1 flagged

999.0.0

Indicators of compromise (SHA-256)

8d25695a7eded18f548d50ed71fd21fb7eed6b20300c158dd0345659df729cc1

d1b554d911cfb6d444727262a62e2db10f22a75d53d23741d6c2684f62fb6e5d

Frequently asked questions

No. @sflyinc-knapsack/shutterfly-react on npm has been identified as a malicious package (version 999.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-004964IN-MAL-2026-004963

References

npmjs.com

Credits

Amazon Inspector · finder

Scan your dependencies

O3 Security blocks malicious packages like this at install time and in CI.

Supply-chain protection