Which versions of crypto-javas are malicious?

The following npm versions of crypto-javas are flagged malicious: 2.0.4, 2.0.6, 2.0.7, 2.0.8, 2.0.9. Treat any of these as compromised.

How do I remediate crypto-javas if I installed it?

crypto-javas is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed crypto-javas — how do I know if it already compromised me?

If crypto-javas was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is crypto-javas part of a known attack campaign?

Yes — crypto-javas is associated with the IN-MAL-2026-014845, IN-MAL-2026-014843, IN-MAL-2026-014840, IN-MAL-2026-018346, IN-MAL-2026-018347 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find crypto-javas across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for crypto-javas (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging crypto-javas across your stack and pipelines.

Malicious package

crypto-javasnpm

crypto-javas is a confirmed malicious npm package (MAL-2026-12359) that steals credentials and exfiltrates sensitive data (malicious versions 2.0.4, 2.0.6, 2.0.7…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in crypto-javas (npm)

MAL-2026-12359

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall crypto-javas

What this malware does

The package's postinstall hook runs setup.js, which enumerates process.env (excluding only a small OS blocklist for PATH/HOME/USER/SHELL/LANG), collects every remaining variable's value together with CI job metadata (CI_JOB_ID, GITHUB_RUN_ID, project, commit, branch, hostname), and HTTPS-POSTs the payload to a URL and API key read from BACKEND_URL/BACKEND_API_KEY, package.json.crypto-javas.backend,.crypto-config.json, or.env in the current working directory. The declared main entrypoint index.js additionally invokes autoExecute() at module top level, instantiating SecretsHandler.readFromEnvironment and sendToBackend so that every require/import of the package re-runs the same environment-variable harvest and POST. The behavior is undisclosed in the README, which presents the package as @wizlabs/js-crypto (a typosquat-style mismatch with the actual name crypto-javas); repository is the placeholder gitlab.com/example/js-crypto and author is a generic DevSecOps handle. In a CI runner this ships AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI_JOB_TOKEN and any other pipeline secrets to an attacker-configurable backend.

Malicious versions

5 flagged

2.0.42.0.62.0.72.0.82.0.9

Indicators of compromise (SHA-256)

51ea78569a1330ed6c2019a0260ba5e128339c2a1d0b42489d2e84c0408a11e6

5a8df6a7a735756b97bf8957dfacf2076f6ea39d4fdc8489755ea14e8c89f9c1

fe1460442a480b91392f6b6b9fde9b5933acca5be28ddd4fc96578099f98e8d5

5fa838fd808c704b14402aca651c52728f92837bcfb94ce9085c692a5324dd1e

75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for crypto-javas (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging crypto-javas across your stack and pipelines.
If you installed it — respond
crypto-javas is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If crypto-javas was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks crypto-javas before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. crypto-javas on npm has been identified as a malicious package (versions 2.0.4, 2.0.6, 2.0.7, 2.0.8, 2.0.9 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-014845IN-MAL-2026-014843IN-MAL-2026-014840IN-MAL-2026-018346IN-MAL-2026-018347

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks crypto-javas-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database