Which versions of eslint-rxjs are malicious?

The following npm versions of eslint-rxjs are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate eslint-rxjs if I installed it?

eslint-rxjs establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed eslint-rxjs — how do I know if it already compromised me?

If eslint-rxjs was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is eslint-rxjs part of a known attack campaign?

Yes — eslint-rxjs is associated with the IN-MAL-2026-019375, IN-MAL-2026-019636 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find eslint-rxjs across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for eslint-rxjs (2 malicious versions).

Malicious package

eslint-rxjsnpm

Advisory published Sep 2, 2026Updated Sep 4, 2026

eslint-rxjs is a confirmed malicious npm package (MAL-2026-15812) that opens a backdoor for remote access (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in eslint-rxjs (npm)

MAL-2026-15812

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall eslint-rxjs

What this malware does

eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate redis with cookies', and the author field impersonates well-known maintainers. The package ships no advertised functionality; index.cjs contains only a beacon helper. The package.json postinstall hook runs scripts/postinstall.cjs, which loads index.cjs and calls onInstall(), unconditionally issuing an HTTP GET to the hardcoded ngrok tunnel https://e493-95-216-46-122.ngrok-free.app/ping at install time. An ngrok-free.app subdomain is ephemeral, attacker-controlled infrastructure with no legitimate use for a published package; the request confirms code execution on the installer's machine and discloses the installer's source IP and install timing to that endpoint. This is the reconnaissance stage of a supply-chain dropper.

The OpenSSF Package Analysis project identified 'eslint-rxjs' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

994311f4267205d33ceb2b43d3f7d72767d384dcc286b6962b5cea13489f7280

61a30ebdfe8d6fb82fe934cf8bc0327f06a336aebc2c73627286451e46c4b59b

2794273ee7e40da4b37c017636209acf1402b1104ab5fc265a43cc7d83228e72

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for eslint-rxjs (2 malicious versions).
If you installed it — respond
eslint-rxjs establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If eslint-rxjs was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. eslint-rxjs on npm has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019375IN-MAL-2026-019636

References

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks eslint-rxjs-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database