Which versions of abuden21 are malicious?

The following npm versions of abuden21 are flagged malicious: 1.7.7. Treat any of these as compromised.

How do I remediate abuden21 if I installed it?

Remove abuden21 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound network activity or persistence. Use O3 Security's dependency scanner to confirm the package and its artifacts are fully purged across your stack.

Is abuden21 part of a known attack campaign?

Yes — abuden21 is associated with the IN-MAL-2026-006860 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

Can O3 Security detect abuden21 in my codebase?

Yes. O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, blocking abuden21 and packages like it before any post-install script runs.

Malicious package

abuden21npm

Malicious code in abuden21 (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5937

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall abuden21

What this malware does

The tarball ships auto-publish.sh, which iterates a hardcoded list of ~90 unrelated package names (imillegal1..N, ishowfeet*, nottuff*, abuden*, ratelimitsucks*) and runs npm publish --silent for each, republishing the same payload under each name. The payload is a browser SPA (Mercury/Scramjet-style web proxy with a Lucide UI) plus heavily obfuscated JS bundles in assets/*.js. package.json has no preinstall/install/postinstall hooks and no bin; the declared main is a browser service worker (sw.js) that calls importScripts/self and throws immediately under Node, so npm install abuden21 and require('abuden21') perform no code execution against the installer. The bundled index.html (and a duplicate inside logo.svg) registers click/keydown/touchstart handlers that open https://abdct.com/ as a popunder on first user gesture when the SPA is served in a browser — monetisation of the web-proxy front-end, not installer-side harm. No credential reads, no outbound exfiltration on install, no RCE, no dropper. The behaviour of concern is namespace pollution: the same tarball is mass-published across many unrelated names to squat the npm namespace and ride traffic / typo'd installs. Routing to human review for namespace-abuse handling; this is not a direct supply-chain attack on installers but is an abuse pattern the registry/feed maintainers may want to act on.

Malicious versions

1 flagged

1.7.7

Indicators of compromise (SHA-256)

4db5b16c4a10377beb73341758a26afed16a44d377dc03009601f610dd289b22

Frequently asked questions

No. abuden21 on npm has been identified as a malicious package (version 1.7.7 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-006860

References

npmjs.com

Credits

Amazon Inspector · finder

Scan your dependencies

O3 Security blocks malicious packages like this at install time and in CI.

Supply-chain protection