Which versions of exodus-checkout are malicious?

The following npm versions of exodus-checkout are flagged malicious: 99.0.0-canary.1. Treat any of these as compromised.

How do I remediate exodus-checkout if I installed it?

exodus-checkout is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed exodus-checkout — how do I know if it already compromised me?

If exodus-checkout was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is exodus-checkout part of a known attack campaign?

Yes — exodus-checkout is associated with the RLMA-2026-05534, IN-MAL-2026-012911, RLUA-2026-06228 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find exodus-checkout across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for exodus-checkout (version 99.0.0-canary.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging exodus-checkout across your stack and pipelines.

Malicious package

exodus-checkoutnpm

exodus-checkout is a confirmed malicious npm package (MAL-2026-10894) that steals credentials and exfiltrates sensitive data (malicious version 99.0.0-canary.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in exodus-checkout (npm)

MAL-2026-10894

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall exodus-checkout

What this malware does

Package exodus-checkout self-identifies as a security-research dependency-confusion proof-of-concept targeting an internal Exodus payments SDK. It mimics the internal API surface (generateMnemonicSigningKeys, signCharge, signRefund, signCancelSubscription in src/index.js), but every exported function throws — there is no functional implementation. On npm install, src/canary.js runs a postinstall hook that performs a DNS lookup and HTTPS GET to a hardcoded serveo SSH-tunnel host (96e03fa6c292469a-172-245-86-254.serveousercontent.com/canary-install), passing the package's own name and version as query parameters. No installer data (env vars, filesystem, credentials) is read or transmitted — the beacon carries only the package's own identity. Installer-side impact: any build that resolves exodus-checkout from public npm (whether by typo, dependency confusion, or accidental inclusion) breaks at runtime because all exports throw, and emits a one-way network signal to a researcher-controlled tunnel domain that is not Exodus infrastructure and cannot be audited by Exodus or the installer. Routing to human review: name-impersonation of a vendor's internal namespace plus an install-time outbound beacon is the dependency-confusion shape, but the absence of any data exfiltration or remote-code-execution mechanism keeps this below the active-attack threshold.

Malicious versions

1 flagged

99.0.0-canary.1

Indicators of compromise (SHA-256)

7675bbf85d1c6736952eca830341836db29b378fbda4a9466645f2ca28a0ac6c

b10e41b9a87dc4927d3c4bc63b25bc1fa438cfae1bcf5f1d483204a18d5765f6

6711b73c156f43b51ac8272c2a4aec48ffc535e413f443a5f8777d6c9260d6ec

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for exodus-checkout (version 99.0.0-canary.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging exodus-checkout across your stack and pipelines.
If you installed it — respond
exodus-checkout is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If exodus-checkout was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks exodus-checkout before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. exodus-checkout on npm has been identified as a malicious package (version 99.0.0-canary.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-05534IN-MAL-2026-012911RLUA-2026-06228

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks exodus-checkout-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database