Which versions of crypto-javas are malicious?

The following npm versions of crypto-javas are flagged malicious: 2.0.4, 2.0.7, 2.0.8. Treat any of these as compromised.

How do I remediate crypto-javas if I installed it?

crypto-javas is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed crypto-javas — how do I know if it already compromised me?

If crypto-javas was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is crypto-javas part of a known attack campaign?

Yes — crypto-javas is associated with the IN-MAL-2026-014845, IN-MAL-2026-014843, IN-MAL-2026-014840 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find crypto-javas across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for crypto-javas (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging crypto-javas across your stack and pipelines.

Malicious package

crypto-javasnpm

crypto-javas is a confirmed malicious npm package (MAL-2026-12359) that steals credentials and exfiltrates sensitive data (malicious versions 2.0.4, 2.0.7, 2.0.8). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in crypto-javas (npm)

MAL-2026-12359

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall crypto-javas

What this malware does

[email protected] registers a postinstall hook ("postinstall": "node setup.js" in package.json) and a top-level autoExecute() in the main index.js that both enumerate process.env, filter out only a small OS-level allowlist (PATH, HOME, USER, SHELL, TERM, LANG, PWD, OLDPWD, TMPDIR, LOGNAME, __CF*), and POST all remaining key/value pairs to an HTTPS backend. getSystemInfo() collects hostname, platform, Node version, and CI identifiers (CI_JOB_ID / GITHUB_RUN_ID, CI_JOB_NAME, CI_PROJECT_NAME, CI_COMMIT_SHA, branch) and includes them in the same POST body, so the receiver knows exactly which pipeline and repository each leaked secret belongs to. loadApiConfig() additionally reads .env in the current working directory and parses BACKEND_URL / BACKEND_API_KEY to configure the exfiltration destination. The package is advertised as a 'secure environment variable handler for GitLab CI/CD' but functionally scrapes non-OS environment variables — CI secrets, cloud credentials, API tokens, database passwords — and ships them off-host at both npm install time and on require/import.

Malicious versions

3 flagged

2.0.42.0.72.0.8

Indicators of compromise (SHA-256)

51ea78569a1330ed6c2019a0260ba5e128339c2a1d0b42489d2e84c0408a11e6

5a8df6a7a735756b97bf8957dfacf2076f6ea39d4fdc8489755ea14e8c89f9c1

fe1460442a480b91392f6b6b9fde9b5933acca5be28ddd4fc96578099f98e8d5

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for crypto-javas (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging crypto-javas across your stack and pipelines.
If you installed it — respond
crypto-javas is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If crypto-javas was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks crypto-javas before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. crypto-javas on npm has been identified as a malicious package (versions 2.0.4, 2.0.7, 2.0.8 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-014845IN-MAL-2026-014843IN-MAL-2026-014840

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks crypto-javas-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database