Which versions of finkrouter are malicious?

The following npm versions of finkrouter are flagged malicious: 0.1.0, 1.1.1, 1.1.2. Treat any of these as compromised.

How do I remediate finkrouter if I installed it?

finkrouter is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed finkrouter — how do I know if it already compromised me?

If finkrouter was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is finkrouter part of a known attack campaign?

Yes — finkrouter is associated with the IN-MAL-2026-004187, IN-MAL-2026-006080, IN-MAL-2026-006081 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find finkrouter across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for finkrouter (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging finkrouter across your stack and pipelines.

Malicious package

finkrouternpm

finkrouter is a confirmed malicious npm package (MAL-2026-4563) that steals credentials and exfiltrates sensitive data (malicious versions 0.1.0, 1.1.1, 1.1.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in finkrouter (npm)

MAL-2026-4563

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall finkrouter

What this malware does

The package's CLI (shipped as cli.obf.js, the javascript-obfuscator output with RC4 string-array encoding and control-flow flattening per package.json prepublishOnly) prompts the user for an Auth Token and then writes ~/.claude/settings.json, setting ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN to a hardcoded API_BASE_URL whose literal is RC4-encoded so installers cannot audit the destination. Once configured, every Claude Code request — including source code, prompts, secrets embedded in prompts, and the Anthropic auth token — is silently relayed through the author's proxy instead of Anthropic. A provisionSentinel() routine writes ~/.fink/sentinel.js and appends (cd ~ && node ~/.fink/sentinel.js &) # Fink Sentinel to ~/.bashrc, ~/.zshrc, ~/.profile (or registers equivalents via PowerShell setx on Windows), giving the daemon persistence across reboots independent of the npm package. installECC() performs git clone <RC4-encoded URL> into ~/.fink, then on subsequent invocations runs git fetch --all && git reset --hard origin/main followed by npm install in the cloned tree — a mutable-branch, unpinned remote-code channel allowing the author to ship arbitrary new code into the installer's home directory on every CLI run. A purgeCaveman() routine additionally tampers with a competing tool's configuration by deleting hooks, agents, and statusLine entries referencing 'caveman' from ~/.claude/settings.json and stripping ## Caveman sections from CLAUDE.md files in $HOME and CWD. Together these constitute credential capture, silent relay of sensitive AI traffic, persistent backdoor, and an unpinned remote-code execution channel.

Malicious versions

3 flagged

0.1.01.1.11.1.2

Indicators of compromise (SHA-256)

ff852ad2ff69ee287dd37d79ea134314ffca73772068117b819495250ff401f3

75cee0798d304ff9f0532df845511df6560314b8808664c15b3c3aa18f1953b5

9ff19d6dc7e3eaa2ae39e6945fc76f54115dd7d885dae5b61b5b0b5c83ea4f6b

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for finkrouter (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging finkrouter across your stack and pipelines.
If you installed it — respond
finkrouter is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If finkrouter was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks finkrouter before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. finkrouter on npm has been identified as a malicious package (versions 0.1.0, 1.1.1, 1.1.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-004187IN-MAL-2026-006080IN-MAL-2026-006081

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks finkrouter-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database