Which versions of apache-arrow-17 are malicious?

The following npm versions of apache-arrow-17 are flagged malicious: 9.9.9. Treat any of these as compromised.

How do I remediate apache-arrow-17 if I installed it?

Remove apache-arrow-17 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed apache-arrow-17 — how do I know if it already compromised me?

If apache-arrow-17 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is apache-arrow-17 part of a known attack campaign?

Yes — apache-arrow-17 is associated with the RLMA-2026-04927, RLUA-2026-06063 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find apache-arrow-17 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for apache-arrow-17 (version 9.9.9).

Malicious package

apache-arrow-17npm

Advisory published Jul 7, 2026Updated Sep 1, 2026

apache-arrow-17 is a confirmed malicious npm package (MAL-2026-7206) that executes malicious code on install (malicious version 9.9.9). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in apache-arrow-17 (npm)

MAL-2026-7206

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall apache-arrow-17

Malicious versions

1 flagged

9.9.9

Indicators of compromise (SHA-256)

7ffe8f08d6950b2f38036661092d221f007696555cb67cac77d1cc32c0cb6a51

6737dd6c10ea51ba2baec78f365904286ed0f4d06a1e1db8a283d96f94f5c17d

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for apache-arrow-17 (version 9.9.9).
If you installed it — respond
Remove apache-arrow-17 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If apache-arrow-17 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. apache-arrow-17 on npm has been identified as a malicious package (version 9.9.9 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04927RLUA-2026-06063

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks apache-arrow-17-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database