Which versions of homestack-cheer are malicious?

The following npm versions of homestack-cheer are flagged malicious: 1.1.9. Treat any of these as compromised.

How do I remediate homestack-cheer if I installed it?

Remove homestack-cheer from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed homestack-cheer — how do I know if it already compromised me?

If homestack-cheer was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is homestack-cheer part of a known attack campaign?

Yes — homestack-cheer is associated with the IN-MAL-2026-020235 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find homestack-cheer across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for homestack-cheer (version 1.1.9). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging homestack-cheer across your stack and pipelines.

Malicious package

homestack-cheernpm

homestack-cheer is a confirmed malicious npm package (MAL-2026-16333) that executes malicious code on install (malicious version 1.1.9). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in homestack-cheer (npm)

MAL-2026-16333

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall homestack-cheer

What this malware does

The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build (dist/my-lib.umd.js) present it as a trivial hello-world 'greet' library. The ESM entrypoint declared in package.json 'module' (src/index.js) and src/env_load.js each end with new Function(atob('<~180KB base64>')).call(this), decoding an obfuscated second-stage payload via a runtime string-shuffle routine. When a downstream project bundles this package with webpack/rollup, the ESM path is resolved and the hidden payload is embedded into the resulting application bundle and executed in end-users' browsers. The decoded payload checks window.location for the substring 'checkout' and, when a Stripe payment element iframe (#stripe-payment-element iframe) is present, hides the real Stripe iframe, clears the disabled state on the place-order button, and injects a look-alike iframe with id __privateStripeFrame84331 to intercept card input. The divergence between the benign main (UMD greet) and the malicious module (ESM Function(atob(...))) constitutes deliberate dual-entrypoint smuggling designed to evade casual review of the package's headline file.

Malicious versions

1 flagged

1.1.9

Indicators of compromise (SHA-256)

f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for homestack-cheer (version 1.1.9). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging homestack-cheer across your stack and pipelines.
If you installed it — respond
Remove homestack-cheer from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If homestack-cheer was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks homestack-cheer before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. homestack-cheer on npm has been identified as a malicious package (version 1.1.9 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020235

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks homestack-cheer-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database