Which versions of dojo-rn-interview are malicious?

The following npm versions of dojo-rn-interview are flagged malicious: 1.0.1, 1.1.1. Treat any of these as compromised.

How do I remediate dojo-rn-interview if I installed it?

dojo-rn-interview establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed dojo-rn-interview — how do I know if it already compromised me?

If dojo-rn-interview was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is dojo-rn-interview part of a known attack campaign?

Yes — dojo-rn-interview is associated with the IN-MAL-2026-017053, GHSA-7phf-cqrv-j3jg, IN-MAL-2026-019773 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dojo-rn-interview across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for dojo-rn-interview (2 malicious versions).

Malicious package

dojo-rn-interviewnpm

Advisory published Aug 7, 2026Updated Sep 9, 2026

dojo-rn-interview is a confirmed malicious npm package (MAL-2026-13549) that opens a backdoor for remote access (malicious versions 1.0.1, 1.1.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in dojo-rn-interview (npm)

MAL-2026-13549

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall dojo-rn-interview

What this malware does

[email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname(), os.userInfo(), os.homedir(), __dirname, and DNS server list, and reads the installer's /etc/passwd and /etc/hosts files, then POSTs the collected data over HTTPS to the hardcoded Burp Collaborator subdomain kqepxa9s4krgw7e7b6f7kufiy943stgi.oastify.com. The package name and behavior are consistent with a dependency-confusion reconnaissance beacon targeting internal build systems.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

2 flagged

1.0.11.1.1

Indicators of compromise (SHA-256)

42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d

469a616c12ee5e0418ab67bca357fcbb29c5ecc46eff755b5f1fa6f330ef6475

52d66b364ae392a578b93daefa907b1c5dea3b81b4bb6ec943d75f39dbab2b97

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for dojo-rn-interview (2 malicious versions).
If you installed it — respond
dojo-rn-interview establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If dojo-rn-interview was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. dojo-rn-interview on npm has been identified as a malicious package (versions 1.0.1, 1.1.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017053GHSA-7phf-cqrv-j3jgIN-MAL-2026-019773

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks dojo-rn-interview-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database