Which versions of carbon-mac-copy-cloner are malicious?

The following npm versions of carbon-mac-copy-cloner are flagged malicious: 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.2.1. Treat any of these as compromised.

How do I remediate carbon-mac-copy-cloner if I installed it?

Remove carbon-mac-copy-cloner from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed carbon-mac-copy-cloner — how do I know if it already compromised me?

If carbon-mac-copy-cloner was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is carbon-mac-copy-cloner part of a known attack campaign?

Yes — carbon-mac-copy-cloner is associated with the RLMA-2026-01138, RLUA-2026-01906 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find carbon-mac-copy-cloner across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for carbon-mac-copy-cloner (12 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging carbon-mac-copy-cloner across your stack and pipelines.

Malicious package

carbon-mac-copy-clonernpm

Malicious code in carbon-mac-copy-cloner (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-1666

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall carbon-mac-copy-cloner

What this malware does

The package carbon-mac-copy-cloner was found to contain malicious code.

Malicious versions

12 flagged

1.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.1.101.2.1

Indicators of compromise (SHA-256)

6dc10e5a9da8538054e84562f967ff14ffcb99ee93aebe555a91d0a95e5e7942

a38d75b9f18088f693edfe80cca42e9c3688457b43560fa568b6f547b9f464c5

1287ed0a0d9b2f4b5fd028c26a7b821290b6d5371ba1cc4e12e7cbac16de1851

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for carbon-mac-copy-cloner (12 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging carbon-mac-copy-cloner across your stack and pipelines.
If you installed it — respond
Remove carbon-mac-copy-cloner from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If carbon-mac-copy-cloner was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks carbon-mac-copy-cloner before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. carbon-mac-copy-cloner on npm has been identified as a malicious package (versions 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, and 4 more flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-01138RLUA-2026-01906

References

reversinglabs.com

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks carbon-mac-copy-cloner-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring