Which versions of hexo-shoka-swiper are malicious?

The following npm versions of hexo-shoka-swiper are flagged malicious: 0.1.10. Treat any of these as compromised.

How do I remediate hexo-shoka-swiper if I installed it?

hexo-shoka-swiper carries a destructive/sabotage payload. Remove it immediately, restore any affected data from clean backups, and verify integrity of build outputs that may have been tampered with.

I already installed hexo-shoka-swiper — how do I know if it already compromised me?

If hexo-shoka-swiper was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is hexo-shoka-swiper part of a known attack campaign?

Yes — hexo-shoka-swiper is associated with the IN-MAL-2026-007572, GHSA-vwrj-pprq-gjvq campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find hexo-shoka-swiper across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for hexo-shoka-swiper (version 0.1.10). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging hexo-shoka-swiper across your stack and pipelines.

Malicious package

hexo-shoka-swipernpm

hexo-shoka-swiper is a confirmed malicious npm package (MAL-2026-6492) that runs destructive / sabotage code (malicious version 0.1.10). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in hexo-shoka-swiper (npm)

MAL-2026-6492

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall hexo-shoka-swiper

What this malware does

The package ships a binding.gyp whose sources field uses GYP command-expansion syntax (<!(...)) at line 6. npm implicitly runs node-gyp rebuild whenever a binding.gyp is present (even with no declared install/postinstall script), and GYP evaluates <!(...) as a shell invocation during the configure step. This means simply running npm install hexo-shoka-swiper causes the embedded shell command to execute on the installer's machine. The package's nominal purpose is a Hexo theme Swiper integration — a pure JavaScript front-end concern with no legitimate need to build a native addon or to evaluate shell at install. The binding.gyp here functions as a lifecycle-hook substitute for arbitrary install-time code execution rather than as a real native-build description.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

0.1.10

Indicators of compromise (SHA-256)

62f045b55721408d94a92f5d65b58d69c98d3dc29d5f4f9327fb8edb4f85eaad

e8de7e493283d0ce9bd580619618dd4fcb9f1b6bc9d2f35c574b2e5bd21a986f

Detection & response playbook

Destructive / sabotage

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for hexo-shoka-swiper (version 0.1.10). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging hexo-shoka-swiper across your stack and pipelines.
If you installed it — respond
hexo-shoka-swiper carries a destructive/sabotage payload. Remove it immediately, restore any affected data from clean backups, and verify integrity of build outputs that may have been tampered with.
Did it already run?
If hexo-shoka-swiper was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks hexo-shoka-swiper before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. hexo-shoka-swiper on npm has been identified as a malicious package (version 0.1.10 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007572GHSA-vwrj-pprq-gjvq

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks hexo-shoka-swiper-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database