Which versions of aftermathfi are malicious?

The following npm versions of aftermathfi are flagged malicious: 99.0.0. Treat any of these as compromised.

How do I remediate aftermathfi if I installed it?

aftermathfi is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed aftermathfi — how do I know if it already compromised me?

If aftermathfi was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is aftermathfi part of a known attack campaign?

Yes — aftermathfi is associated with the IN-MAL-2026-010902 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find aftermathfi across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for aftermathfi (version 99.0.0).

Malicious package

aftermathfinpm

Advisory published Jul 20, 2026Updated Jul 28, 2026

aftermathfi is a confirmed malicious npm package (MAL-2026-10943) that steals credentials and exfiltrates sensitive data (malicious version 99.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in aftermathfi (npm)

MAL-2026-10943

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall aftermathfi

What this malware does

The aftermathfi package was published to the npm registry by user 'jet0010001' (maintainer email [email protected]) as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK (Aftermath Finance is a DeFi protocol on the Sui blockchain). The package was published at version 99.0.0 - an inflated version number characteristic of dependency-confusion attacks, intended to cause a misconfigured resolver to prefer this public lookalike over the intended private/internal dependency of the same name.

The package declares a preinstall hook ("node setup.js || true") that executes automatically at npm install time, before any application code runs. The bundled setup.js performs host reconnaissance and credential harvesting: it collects the machine hostname, the current OS username, the current working directory, the contents of /etc/hostname, and the output of 'git remote -v', and it enumerates process environment variables whose names match the pattern /key|secret|token|pass|auth|private|drone|gitea|sui|admin|deploy/i - capturing API keys, secrets, tokens, passwords, and Sui/deploy/CI credentials. The collected data is serialized to JSON and exfiltrated via an HTTPS POST to the hardcoded attacker-controlled endpoint https://2.25.140.71:8443/aftermath/npm-dep-conf, with TLS certificate verification disabled (rejectUnauthorized: false) so a self-signed listener is accepted. Errors are silently swallowed so the install appears to succeed. The published module code (index.js) is a benign stub exporting only { version: "99.0.0" }, consistent with a package built solely to deliver the install-time beacon.

The install-time payload is byte-for-byte identical across the campaign's packages (aftermath-finance, aftermath-sui, aftermathfi), all published by the same maintainer within seconds of each other and all beaconing to the same collector.

The package's preinstall script (setup.js) runs automatically during npm install and harvests installer-side data. It iterates process.env and filters keys matching credential-shaped patterns (key/secret/token/pass/auth/private/drone/gitea/sui/admin/deploy), and via execSync collects hostname, /etc/hostname, username, current working directory, and git remote -v output. The collected data is POSTed over HTTPS to the hardcoded bare-IP endpoint https://2.25.140.71:8443/aftermath/npm-dep-conf with TLS certificate validation disabled (rejectUnauthorized:false). The destination is not a documented first-party service, and the behavior fires unconditionally on install with no opt-in.

Malicious versions

1 flagged

99.0.0

Indicators of compromise (SHA-256)

556ad9b21010fc9541cf77cae90893323621b194137c16ea6e3bd67744366a51

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for aftermathfi (version 99.0.0).
If you installed it — respond
aftermathfi is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If aftermathfi was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. aftermathfi on npm has been identified as a malicious package (version 99.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010902

References

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks aftermathfi-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database