Which versions of disksweep are malicious?

The following npm versions of disksweep are flagged malicious: 1.0.0, 3.0.0. Treat any of these as compromised.

How do I remediate disksweep if I installed it?

Remove disksweep from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed disksweep — how do I know if it already compromised me?

If disksweep was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is disksweep part of a known attack campaign?

Yes — disksweep is associated with the IN-MAL-2026-007655, IN-MAL-2026-007656 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find disksweep across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for disksweep (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging disksweep across your stack and pipelines.

Malicious package

disksweepnpm

Malicious code in disksweep (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6535

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall disksweep

What this malware does

The package ships a 2.9 MB Windows PE32+ executable at bin/native/parser.node (sha256 b1aace6c70312a39ca39e6bba1d9abc6aaf9b23171089b1a548adc89f67f83c3) that is not mentioned in the README or CHANGELOG. src/index.js (lines 30-34) contains a loader that resolves this file via __dirname and calls process.dlopen(module, p) inside a try/catch, which would load the binary as a native Node addon with full FFI access to the host process. The README explicitly claims 'Zero runtime dependencies… nothing to audit', directly contradicting the presence of an opaque attacker-supplied native binary. The current release is dormant on most installs because the package declares ESM ('type':'module') while the loader uses CJS-only globals (require, __dirname, module), so the dlopen call throws and is swallowed — but the binary is staged on disk and a one-line patch (switching to createRequire or fileURLToPath) flips it live for every installer. Supporting weak-attribution signals: package.json repository.url points at the npm package page rather than a real source repository, bugs.url is the same placeholder, author is the generic 'disksweep contributors', and CHANGELOG documents only v1.0.0 despite the published version being 3.0.0. The combination of opaque Windows-only native binary, doc/contents mismatch ('zero dependencies' marketing), placeholder metadata hiding maintainer identity, and a pre-wired dlopen loader is the staged-native-payload pattern.

Malicious versions

2 flagged

1.0.03.0.0

Indicators of compromise (SHA-256)

31a2c10aba7f3468458529214868e2d8acd9717eb7985c47ab10cf4aed64f87c

49b8ad00b1eafea2b5bccbeee95cb7321b92c72f79ba917a9fc00f19104ebbcf

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for disksweep (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging disksweep across your stack and pipelines.
If you installed it — respond
Remove disksweep from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If disksweep was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks disksweep before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. disksweep on npm has been identified as a malicious package (versions 1.0.0, 3.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007655IN-MAL-2026-007656

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks disksweep-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring