Which versions of ac-dom-nodes are malicious?

The following npm versions of ac-dom-nodes are flagged malicious: 1.9.0, 1.9.1, 99.9.9. Treat any of these as compromised.

How do I remediate ac-dom-nodes if I installed it?

Remove ac-dom-nodes from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed ac-dom-nodes — how do I know if it already compromised me?

If ac-dom-nodes was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is ac-dom-nodes part of a known attack campaign?

Yes — ac-dom-nodes is associated with the RLMA-2026-01088, RLUA-2026-01873 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find ac-dom-nodes across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for ac-dom-nodes (3 malicious versions).

Malicious package

ac-dom-nodesnpm

Advisory published Feb 6, 2026Updated Apr 16, 2026

ac-dom-nodes is a confirmed malicious npm package (MAL-2026-778) that executes malicious code on install (malicious versions 1.9.0, 1.9.1, 99.9.9). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in ac-dom-nodes (npm)

MAL-2026-778

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall ac-dom-nodes

What this malware does

The package ac-dom-nodes was found to contain malicious code.

The OpenSSF Package Analysis project identified 'ac-dom-nodes' @ 1.9.0 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

3 flagged

1.9.01.9.199.9.9

Indicators of compromise (SHA-256)

b323cec1a59645d9dcb2c0951a0f7d31b362ac58e4f930306a940ed67037b20d

e4ba72c418b98dcfe5864050915ff801c6714ac42005dd039c8823f04231bdd6

cb37b1ac0be57beafb46fd9aabbed186da9c5c28461f8f212e1b8c1a5c7a6ee9

4da45ea927e50724fa5b0743f17d83738ac4959a09e41238063506c7fde51736

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for ac-dom-nodes (3 malicious versions).
If you installed it — respond
Remove ac-dom-nodes from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If ac-dom-nodes was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. ac-dom-nodes on npm has been identified as a malicious package (versions 1.9.0, 1.9.1, 99.9.9 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-01088RLUA-2026-01873

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder
ReversingLabs · finder

Detect & block this

O3 blocks ac-dom-nodes-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database