Which versions of canary-ci-test are malicious?

The following npm versions of canary-ci-test are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate canary-ci-test if I installed it?

Remove canary-ci-test from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound network activity or persistence. Use O3 Security's dependency scanner to confirm the package and its artifacts are fully purged across your stack.

Is canary-ci-test part of a known attack campaign?

Yes — canary-ci-test is associated with the IN-MAL-2026-006885 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

Can O3 Security detect canary-ci-test in my codebase?

Yes. O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, blocking canary-ci-test and packages like it before any post-install script runs.

Malicious package

canary-ci-testnpm

Malicious code in canary-ci-test (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5972

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall canary-ci-test

What this malware does

On npm install, the package's postinstall lifecycle script (postinstall.js) collects installer-side host identifiers — os.hostname(), os.userInfo().username, process.cwd(), platform, and a DNS resolution result — and POSTs them as JSON to the hardcoded endpoint https://opgelost.nu/ (BEACON_URL declared at postinstall.js:15; HTTPS request constructed at line 31; POST issued at line 33; payload assembled at lines 58-66). The fetch fires automatically with no opt-in, and errors are silently swallowed so installers see no indication of the outbound beacon. The behavior is unrelated to any documented package purpose and matches a classic install-time phone-home exfiltration pattern. The package's own metadata declares it to be a scanner test fixture; the executed code, however, is functional exfiltration that runs against any machine that installs it.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

a572fd7ffa39ecc1ba62c71d1dfe31722bfbe0c4118b7ab8400c1d5f4a61ba0f

Frequently asked questions

No. canary-ci-test on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-006885

References

npmjs.com

Credits

Amazon Inspector · finder

Scan your dependencies

O3 Security blocks malicious packages like this at install time and in CI.

Supply-chain protection