Which versions of gx-npm-lib are malicious?

The following npm versions of gx-npm-lib are flagged malicious: 99.99.99. Treat any of these as compromised.

How do I remediate gx-npm-lib if I installed it?

gx-npm-lib is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed gx-npm-lib — how do I know if it already compromised me?

If gx-npm-lib was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is gx-npm-lib part of a known attack campaign?

Yes — gx-npm-lib is associated with the IN-MAL-2026-007560, GHSA-wcmr-4783-pq3p campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find gx-npm-lib across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for gx-npm-lib (version 99.99.99). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging gx-npm-lib across your stack and pipelines.

Malicious package

gx-npm-libnpm

gx-npm-lib is a confirmed malicious npm package (MAL-2026-6480) that steals credentials and exfiltrates sensitive data (malicious version 99.99.99). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in gx-npm-lib (npm)

MAL-2026-6480

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall gx-npm-lib

What this malware does

Package published at version 99.99.99 under a generic name (gx-npm-lib) — the canonical dependency-confusion shape used to overshadow internal packages in CI version resolution. The postinstall lifecycle script runs node beacon.js, which collects installer metadata (package name, os.hostname(), os.userInfo() username, process.cwd(), the names of process.env variables, and Node version) and exfiltrates it via two channels to the hardcoded attacker-controlled OAST domain d8uectoqtvskhftsa940pm3kth3ahdxn4.oast.me: (1) a DNS lookup encoding pkg.host.user as subdomains, and (2) a base64-encoded HTTPS GET to https://d8uectoqtvskhftsa940pm3kth3ahdxn4.oast.me/<pkg>?d=<base64>. The package self-describes as a 'security-research placeholder' for a dependency-confusion PoC, but that self-label does not constitute installer consent — npm install in any environment where this package resolves (CI for an internal gx-npm-lib, or a developer mistyping) leaks host/user/cwd/environment inventory to the attacker's OAST collector. Multi-channel (DNS + HTTPS+base64) exfiltration to a hardcoded interactsh-style domain on a default install is a textbook active supply-chain attack.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

99.99.99

Indicators of compromise (SHA-256)

e919710d2f28ec776b8165821ebe2fbe480c1e432ec9416c7b73bd1315ee6a6e

de1b5709aec5da1ffdf3a44dcb78b36dc7aa0d65aa499feca4d6f07dd0ae6011

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for gx-npm-lib (version 99.99.99). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging gx-npm-lib across your stack and pipelines.
If you installed it — respond
gx-npm-lib is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If gx-npm-lib was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks gx-npm-lib before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. gx-npm-lib on npm has been identified as a malicious package (version 99.99.99 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007560GHSA-wcmr-4783-pq3p

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks gx-npm-lib-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database