Which versions of ecto-cargo-wk1tm59a are malicious?

The following npm versions of ecto-cargo-wk1tm59a are flagged malicious: 99.0.0. Treat any of these as compromised.

How do I remediate ecto-cargo-wk1tm59a if I installed it?

ecto-cargo-wk1tm59a is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed ecto-cargo-wk1tm59a — how do I know if it already compromised me?

If ecto-cargo-wk1tm59a was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is ecto-cargo-wk1tm59a part of a known attack campaign?

Yes — ecto-cargo-wk1tm59a is associated with the RLMA-2026-05530, IN-MAL-2026-012955, RLUA-2026-06181 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find ecto-cargo-wk1tm59a across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for ecto-cargo-wk1tm59a (version 99.0.0).

Malicious package

ecto-cargo-wk1tm59anpm

Advisory published Jul 20, 2026Updated Sep 1, 2026

ecto-cargo-wk1tm59a is a confirmed malicious npm package (MAL-2026-10893) that steals credentials and exfiltrates sensitive data (malicious version 99.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in ecto-cargo-wk1tm59a (npm)

MAL-2026-10893

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall ecto-cargo-wk1tm59a

What this malware does

Package [email protected] exhibits several contextual red flags worth human review: a randomized-suffix name pattern (-wk1tm59a) typical of disposable/throwaway publishes, an inflated 99.0.0 version typical of dependency-confusion / proof-of-concept publishes, and only 3 files in the tarball. Automated content inspection of the package's code did not produce a usable trace, but the content was non-trivial enough that an automated description could not be produced. No specific attacker domain, exfiltration endpoint, or install-time fetch-and-execute behavior has been concretely identified from the available evidence, so a public block verdict is not justified, but the combination of disposable-name shape, 99.0.0 version inflation, and untraced contents warrants human inspection before this package is trusted.

Malicious versions

1 flagged

99.0.0

Indicators of compromise (SHA-256)

4d658031a727ec8ae264cb396f9e130d1c4cb8c28f803b2275bb45a09fb01507

ee496f01ecebc77637213e597ba523c8cccda7efcd65e7ad2e700d804553dd29

e53b8340ac7ffea00b9252f6026d200b5552e4c5a35aa338a09b00fc2812c70f

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for ecto-cargo-wk1tm59a (version 99.0.0).
If you installed it — respond
ecto-cargo-wk1tm59a is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If ecto-cargo-wk1tm59a was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. ecto-cargo-wk1tm59a on npm has been identified as a malicious package (version 99.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-05530IN-MAL-2026-012955RLUA-2026-06181

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks ecto-cargo-wk1tm59a-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database