Which versions of fkext-browser-min are malicious?

The following npm versions of fkext-browser-min are flagged malicious: 1.0.14. Treat any of these as compromised.

How do I remediate fkext-browser-min if I installed it?

fkext-browser-min is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed fkext-browser-min — how do I know if it already compromised me?

If fkext-browser-min was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is fkext-browser-min part of a known attack campaign?

Yes — fkext-browser-min is associated with the IN-MAL-2026-009728, RLMA-2026-05540, RLUA-2026-06243 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find fkext-browser-min across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for fkext-browser-min (version 1.0.14).

Malicious package

fkext-browser-minnpm

Advisory published Jul 10, 2026Updated Sep 1, 2026

fkext-browser-min is a confirmed malicious npm package (MAL-2026-10183) that steals credentials and exfiltrates sensitive data (malicious version 1.0.14). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in fkext-browser-min (npm)

MAL-2026-10183

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall fkext-browser-min

What this malware does

The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects os.hostname() and GitHub Actions / CI environment variables (GITHUB_*), and transmits them as query parameters to a hardcoded webhook.site collector URL over HTTPS. It additionally performs a DNS lookup of a subdomain of the form ping-<hostname>.<collaborator>.oastify.com, providing an out-of-band exfiltration channel (Burp Collaborator style) that bypasses HTTP egress filters. There is no legitimate functionality shipped alongside this — the package's only install-time effect is host reconnaissance and beacon-out to attacker-controlled sinks. This is a dependency-confusion / bug-bounty-style beacon against installer/CI environments.

Malicious versions

1 flagged

1.0.14

Indicators of compromise (SHA-256)

1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c

34c36db539a94663e23abbab6291033237a0f58136fb2f46e59f77cb39a00cd0

0fb0dd978b102e77629950113b3d700eaf2e49cba045f94bf6686cbdbddcb12a

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for fkext-browser-min (version 1.0.14).
If you installed it — respond
fkext-browser-min is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If fkext-browser-min was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. fkext-browser-min on npm has been identified as a malicious package (version 1.0.14 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009728RLMA-2026-05540RLUA-2026-06243

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks fkext-browser-min-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database