Which versions of auth-gen-next are malicious?

The following npm versions of auth-gen-next are flagged malicious: 1.7.13. Treat any of these as compromised.

How do I remediate auth-gen-next if I installed it?

auth-gen-next is a typosquat — you almost certainly intended a legitimately-named package. Remove auth-gen-next, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed auth-gen-next — how do I know if it already compromised me?

If auth-gen-next was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is auth-gen-next part of a known attack campaign?

Yes — auth-gen-next is associated with the IN-MAL-2026-010258 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find auth-gen-next across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for auth-gen-next (version 1.7.13). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging auth-gen-next across your stack and pipelines.

Malicious package

auth-gen-nextnpm

Malicious code in auth-gen-next (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10449

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall auth-gen-next

What this malware does

The package impersonates the pino logger (README assets, keywords, and internal filenames such as lib/proto.js, lib/multistream.js, lib/redaction.js, lib/transport.js, lib/writer.js are pino-branded) but its declared purpose is unrelated. On require, index.js loads lib/writer.js, which builds an object containing the full process.env, os.platform(), os.hostname(), os.userInfo().username, and non-internal MAC addresses, then unconditionally invokes context.data() from lib/content.js. That function issues an axios GET to https://pro-api.coinmarketcap.com/public-api/v1/ and eval()s a heavily obfuscated string (obfuscator.io-style string array with base64/XOR/RC4 decoders) that reconstructs a JSON-RPC eth_call transport, XOR-decodes the response, and spawns a child process using process.execPath to execute the retrieved payload. lib/writer.js additionally contains a hex-encoded fallback loader decoding to https://www.jsonkeeper.com/b/HY6M6. lib/content.js is heavily obfuscated (while(!![]), array-shift decoder) to hide the destinations and payload from review.

Malicious versions

1 flagged

1.7.13

Indicators of compromise (SHA-256)

49e38202e2579f6591dbc161817859bb99a212cbf6c1e5482b3271acf8fc4de0

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for auth-gen-next (version 1.7.13). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging auth-gen-next across your stack and pipelines.
If you installed it — respond
auth-gen-next is a typosquat — you almost certainly intended a legitimately-named package. Remove auth-gen-next, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If auth-gen-next was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks auth-gen-next before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. auth-gen-next on npm has been identified as a malicious package (version 1.7.13 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010258

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks auth-gen-next-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring