Which versions of faceplate-docs are malicious?

The following npm versions of faceplate-docs are flagged malicious: 1.0.0, 99.9.9, 99.9.10. Treat any of these as compromised.

How do I remediate faceplate-docs if I installed it?

faceplate-docs establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed faceplate-docs — how do I know if it already compromised me?

If faceplate-docs was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is faceplate-docs part of a known attack campaign?

Yes — faceplate-docs is associated with the RLMA-2024-00999, RLUA-2024-06564, IN-MAL-2026-020325, IN-MAL-2026-020324 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find faceplate-docs across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for faceplate-docs (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging faceplate-docs across your stack and pipelines.

Malicious package

faceplate-docsnpm

faceplate-docs is a confirmed malicious npm package (MAL-2024-2355) that opens a backdoor for remote access (malicious versions 1.0.0, 99.9.9, 99.9.10). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in faceplate-docs (npm)

MAL-2024-2355

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall faceplate-docs

What this malware does

[email protected] runs index.js from a postinstall hook that collects the installer's OS username, current working directory, hostname, and local IPv4 address and POSTs them as JSON to a hardcoded anonymous collector at https://webhook.site/f9bff304-3053-4d54-be05-86537267514a. The beacon fires automatically on npm install without any user interaction. The package name plus implausibly high version (99.9.10) and the recon-only payload are characteristic of a dependency-confusion probe designed to identify internal build environments that mistakenly resolve a private package name from the public registry.

Malicious versions

3 flagged

1.0.099.9.999.9.10

Indicators of compromise (SHA-256)

62fca832a92eea3afa7f618b4dc1d7836667d7dfebc1bdf74101b3089cd6b4c6

affa8e86727aac03b3de13a058923786285a642dea2a4caf7e4fbc6f5f3cc5f3

6f62abf7b41e2c3fc246dbe3a35af15b8ef48e4ce1547e57ba3053668a82e8bd

f5198954164869432a0fda9f3f723c1db53531ab2f73db84523e6f62946cf420

Detection & response playbook

Backdoor / remote access

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for faceplate-docs (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging faceplate-docs across your stack and pipelines.
If you installed it — respond
faceplate-docs establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If faceplate-docs was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks faceplate-docs before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. faceplate-docs on npm has been identified as a malicious package (versions 1.0.0, 99.9.9, 99.9.10 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-00999RLUA-2024-06564IN-MAL-2026-020325IN-MAL-2026-020324

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks faceplate-docs-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database