NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

eslint-config-compact-utilsnpm

Advisory published Updated

eslint-config-compact-utils is a confirmed malicious npm package (MAL-2026-16417) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in eslint-config-compact-utils (npm)

MAL-2026-16417
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall eslint-config-compact-utils

What this malware does

On require, index.js collects host reconnaissance data (os.hostname(), os.userInfo().username, os.platform(), architecture, Node version, current working directory) together with CI/repository environment variables (CI, RUNNER_NAME, GITHUB_REPOSITORY) and sends them as query parameters via https.get to the hardcoded endpoint https://cbrsuo9293.execute-api.us-east-1.amazonaws.com/c. The exfiltration fires as a side effect of importing the module and is unrelated to the package's advertised ESLint configuration purpose. The shape (import-time beacon carrying host identity plus CI/repo identifiers to a non-first-party AWS API Gateway) is consistent with dependency-confusion / typosquat reconnaissance.

The OpenSSF Package Analysis project identified 'eslint-config-compact-utils' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.

Malicious versions

2 flagged
1.0.01.0.2

Indicators of compromise (SHA-256)

414c7f8397efb591ffe6f87f9c44e8eb803606eb4789d357abe337d3225cc46f
bc5522528e8b5b20c598dc3047008916fc237ee068e6e1a24d8709ee5d451de5

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for eslint-config-compact-utils (2 malicious versions).

  2. If you installed it — respond

    eslint-config-compact-utils is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If eslint-config-compact-utils was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. eslint-config-compact-utils on npm has been identified as a malicious package (versions 1.0.0, 1.0.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020312

References

Credits

  • Amazon Inspector · finder
  • OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks eslint-config-compact-utils-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
eslint-config-compact-utils (npm) malicious package — MAL-2026-16417 | O3 Security