Which versions of configcat-trello-powerup are malicious?

The following npm versions of configcat-trello-powerup are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate configcat-trello-powerup if I installed it?

configcat-trello-powerup establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed configcat-trello-powerup — how do I know if it already compromised me?

If configcat-trello-powerup was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is configcat-trello-powerup part of a known attack campaign?

Yes — configcat-trello-powerup is associated with the IN-MAL-2026-004021, IN-MAL-2026-004020 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find configcat-trello-powerup across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for configcat-trello-powerup (version 1.0.0).

Malicious package

configcat-trello-powerupnpm

Advisory published May 21, 2026Updated May 26, 2026

configcat-trello-powerup is a confirmed malicious npm package (MAL-2026-4535) that opens a backdoor for remote access (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in configcat-trello-powerup (npm)

MAL-2026-4535

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall configcat-trello-powerup

What this malware does

package.json declares "preinstall": "node index.js", which fires automatically on npm install. index.js collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers) and reads sensitive system files (/etc/passwd, /etc/hosts) plus package metadata, then HTTPS POSTs the bundle to a hardcoded Burp Collaborator subdomain hzklpyrf8gdhgtycz16veroqihobc10q.oastify.com. The package ships no real functionality — empty description, empty author, and a name resembling a plausible internal Trello/ConfigCat integration — fingerprint of a dependency-confusion squat whose only purpose is to beacon installer-side data to the attacker for follow-on targeting.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

408ece81736dc366c6b5bbe4bb43186d622df67d9c0b675ace108f1b74439a08

5365489bc7a763096bf4be47f80bd47e4513917d8b37ba2754e33ae11983872b

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for configcat-trello-powerup (version 1.0.0).
If you installed it — respond
configcat-trello-powerup establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If configcat-trello-powerup was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. configcat-trello-powerup on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-004021IN-MAL-2026-004020

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks configcat-trello-powerup-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database