Which versions of forge-jsx2 are malicious?

The following npm versions of forge-jsx2 are flagged malicious: 1.0.123, 1.0.124, 1.0.125, 1.0.126. Treat any of these as compromised.

How do I remediate forge-jsx2 if I installed it?

forge-jsx2 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed forge-jsx2 — how do I know if it already compromised me?

If forge-jsx2 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is forge-jsx2 part of a known attack campaign?

Yes — forge-jsx2 is associated with the IN-MAL-2026-005473, IN-MAL-2026-005474, GHSA-hqj4-8wc5-r66r, IN-MAL-2026-008809, IN-MAL-2026-008797, IN-MAL-2026-009452 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find forge-jsx2 across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for forge-jsx2 (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging forge-jsx2 across your stack and pipelines.

Malicious package

forge-jsx2npm

forge-jsx2 is a confirmed malicious npm package (MAL-2026-5568) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.123, 1.0.124, 1.0.125…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in forge-jsx2 (npm)

MAL-2026-5568

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall forge-jsx2

What this malware does

The package masquerades as an 'Autodesk Forge' integration but ships no Forge API code. On npm install, scripts/postinstall-agent.mjs materializes a durable copy of the package outside node_modules (under a hidden .forge-jsxyz/runtime/ directory), spawns dist/cli-agent.js as a detached, unrefed background process, and registers OS autostart (launchd/systemd/Windows Run) so the agent survives npm uninstall. The agent's relay WebSocket destination is concealed via AES-256-GCM with a key reconstructed from XOR-obfuscated halves embedded in dist/deploymentCipherData.js; a leftover diagnostic script (scripts/windows-forge-diagnostics.ps1) reveals the hidden host as 212.193.3.61:9877. Once connected, the agent (1) walks the entire filesystem (/ on POSIX, every drive on Windows) via dist/secretScan/agentStartupAudit.js looking for BIP39 mnemonics, secp256k1 private keys, BIP32 xprv/zprv, and WIF keys, then uploads results including the secret material to an attacker-controlled HuggingFace repo at agents/<hostname>/result.json; (2) enumerates every local user profile and recursively copies Chromium-family Local Extension Settings/<extension_id>/ and IndexedDB/chrome-extension_* LevelDB trees (where MetaMask and other wallet extensions store keys) via dist/chromiumExtensionDbHarvest.js and uploads them to HuggingFace via dist/extensionDbHfUpload.js; (3) periodically captures desktop screenshots (10–600s interval) and relays them to a Discord channel via dist/discordRelayUpload.js using https://discord.com/api/v10; (4) exposes a remote filesystem read/write explorer and keyboard/clipboard injection (fsProtocol.js, filesExplorer.js, windowsInputSync, win32InputNative) to the relay operator, gated only by a default password baked into the encrypted bundle.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

4 flagged

1.0.1231.0.1241.0.1251.0.126

Indicators of compromise (SHA-256)

0ce40276c3c58337b7db3272f89e0716b017b4d63bfa625b8757b9d1969ec9f9

1ceb3d1b945579feb78a08be2871161319044d516dd9b9b1d2531e385ca8fcc1

cdda3bc454a770043918f1aa9dd3a90ab538733787b052229819c1eeca3488b9

ca6e1f76e8e10b4d899a3425356f60df01acbf6632b4c557bf12894830b2d89b

f3e27be068106d1a0ebe1f2b3825bcf047c44021291d240fdccd9e22dfc24b4c

7c1fe0f5f68a82696bba5571e3b163a2158dfb825fc2734ff475b5b8ad12b0be

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for forge-jsx2 (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging forge-jsx2 across your stack and pipelines.
If you installed it — respond
forge-jsx2 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If forge-jsx2 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks forge-jsx2 before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. forge-jsx2 on npm has been identified as a malicious package (versions 1.0.123, 1.0.124, 1.0.125, 1.0.126 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005473IN-MAL-2026-005474GHSA-hqj4-8wc5-r66rIN-MAL-2026-008809IN-MAL-2026-008797IN-MAL-2026-009452

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks forge-jsx2-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database