concierge-sdknpm
Advisory published Updated
concierge-sdk is a confirmed malicious npm package (MAL-2026-16145) that steals credentials and exfiltrates sensitive data (malicious versions 99.99.99, 99.99.100, 99.99.101). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in concierge-sdk (npm)
What this malware does
The package's declared postinstall script executes exfil_v2.js at npm install time. That script harvests the full process environment, current working directory, and config/secret files (.env, secrets.json, /etc/environment, /etc/profile, workflow files, git-history secret matches), curls the Azure Instance Metadata Service at 169.254.169.254 to obtain a managed-identity access token for vault.azure.net and lists Key Vault secrets with it, and uses the runner's GITHUB_TOKEN against api.github.com to read repository secrets and Actions artifacts. All collected data is POSTed to a hardcoded webhook.site endpoint. A sibling exfil.js duplicates full process.env exfiltration to the same webhook.site collector under User-Agent continental-sdk/1.0.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Search your lockfiles and build artifacts for concierge-sdk (3 malicious versions).
If you installed it — respond
concierge-sdk is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If concierge-sdk was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks concierge-sdk-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.