Which versions of @zynkit/jwtbytes are malicious?

The following npm versions of @zynkit/jwtbytes are flagged malicious: 0.4.3, 0.5.1, 0.5.2, 0.5.3, 0.5.4. Treat any of these as compromised.

How do I remediate @zynkit/jwtbytes if I installed it?

@zynkit/jwtbytes is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed @zynkit/jwtbytes — how do I know if it already compromised me?

If @zynkit/jwtbytes was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @zynkit/jwtbytes part of a known attack campaign?

Yes — @zynkit/jwtbytes is associated with the IN-MAL-2026-007283, IN-MAL-2026-007285, IN-MAL-2026-007282, IN-MAL-2026-007286, IN-MAL-2026-007279 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @zynkit/jwtbytes across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @zynkit/jwtbytes (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @zynkit/jwtbytes across your stack and pipelines.

Malicious package

@zynkit/jwtbytesnpm

Malicious code in @zynkit/jwtbytes (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6313

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @zynkit/jwtbytes

What this malware does

@zynkit/jwtbytes (malicious version 0.5.3, published by [email protected]) is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern <scope>-<6 random chars>@wshu.net, with every scope created on June 4, 2026 in a ~40-minute burst. This package masquerades as a JWT byte helper and ships real, working utility code (decoy base32/58/64/hex/ascii85 encoders) so it passes a glance, while bundling a much larger malicious payload at dist/prelude.cjs. package.json declares a postinstall hook ("node dist/prelude.cjs") that runs the payload automatically on npm install. The payload is heavily obfuscated with javascript-obfuscator (hex-named identifiers, a while (!![]) array-rotation IIFE, base64+RC4 string decoding, control-flow flattening, and runtime-decrypted module resolution to stay out of the static module graph). At runtime it is a Chromium browser credential stealer: it reads Chromium Cookies and Login Data and decrypts saved passwords protected by AES-256-GCM (the v10/v11 app-bound key schemes), then exfiltrates them over HTTPS using a spoofed Mozilla/5.0 user agent. Malicious payload dist/prelude.cjs SHA-256: d06ee17d30ebb333ab2e5b6e8a1324fcf95edaaae17b6793ec0f3647338efda1.

The package's main entry dist/mod.cjs begins with require('./prelude.cjs').runPrepare();, so any require('@zynkit/jwtbytes') auto-runs a 280 KB obfuscator.io-style IIFE in dist/prelude.cjs. The IIFE uses an RC4+base64 string-array decoder, anti-debug traps (RegExp/setInterval, console neutralization, --inspect/--inspect-brk checks), and AES-256-GCM ciphertexts decrypted with XOR-derived keys to reconstruct an HTTPS URL at runtime. It then re-execs the current Node process with a sentinel environment variable, fetches a payload to os.tmpdir(), marks it executable, and spawns it via process.execPath or /bin/sh -c. The legitimate codec sources from github.com/dahlia/byte-encodings are bundled verbatim under an unrelated publisher (zynkit <[email protected]>) while reusing the upstream homepage/repository URLs as a lure; the prelude.cjs loader is not present upstream and has been grafted on. The obfuscated loader (~280 KB) dwarfs the ~4 KB of advertised codec source. Importing this package in a developer or CI environment results in remote code execution under attacker control.

Malicious versions

5 flagged

0.4.30.5.10.5.20.5.30.5.4

Indicators of compromise (SHA-256)

5159f8eb6f94c520a2c4b64a5e0d1261dd26b14de070d6def6aef940161e6a8f

56c346069fc4ee120281c9431c9f9544452f0d67b783df08750e00faaba5251b

ba47eb25bbf0e3c728fe5f954af9c015b07bc4b3d28e3a3a21055ab73a361200

f0688f5e5af8942f29348988efd603a5c379c698bb6d886f2e231da902909304

fb68ae44b21436638ce989a68d8c1e3ce01be3b793ec3a89c4b055a4560efb87

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @zynkit/jwtbytes (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @zynkit/jwtbytes across your stack and pipelines.
If you installed it — respond
@zynkit/jwtbytes is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @zynkit/jwtbytes was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @zynkit/jwtbytes before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @zynkit/jwtbytes on npm has been identified as a malicious package (versions 0.4.3, 0.5.1, 0.5.2, 0.5.3, 0.5.4 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007283IN-MAL-2026-007285IN-MAL-2026-007282IN-MAL-2026-007286IN-MAL-2026-007279

References

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks @zynkit/jwtbytes-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring