Which versions of hubmabels are malicious?

The following npm versions of hubmabels are flagged malicious: 8.29.2. Treat any of these as compromised.

How do I remediate hubmabels if I installed it?

Remove hubmabels from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed hubmabels — how do I know if it already compromised me?

If hubmabels was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is hubmabels part of a known attack campaign?

Yes — hubmabels is associated with the GHSA-qwq9-q52c-wfjq, RLMA-2025-05037, RLUA-2026-01345 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find hubmabels across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for hubmabels (version 8.29.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging hubmabels across your stack and pipelines.

Malicious package

hubmabelsnpm

hubmabels is a confirmed malicious npm package (MAL-2025-47070) that executes malicious code on install (malicious version 8.29.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in hubmabels (npm)

MAL-2025-47070

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall hubmabels

What this malware does

The package hubmabels was found to contain malicious code.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

8.29.2

Indicators of compromise (SHA-256)

63ce5bde998604e80498a1f950aa6e92745b3011c1826f35e2e431b081b2a837

96d63270c5a309c8b8575edf7a2251bd4429935beaad66103ef010b68d1982cd

cd3da3a5468462d97d663cf6b1f69ad2458cbf577f5c8502104dd0cf89c9529c

9fc27a4121f2f1bbc983335a4a5297b0486d4d5f1512671e36b48aa2c711a9c0

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for hubmabels (version 8.29.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging hubmabels across your stack and pipelines.
If you installed it — respond
Remove hubmabels from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If hubmabels was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks hubmabels before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. hubmabels on npm has been identified as a malicious package (version 8.29.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-qwq9-q52c-wfjqRLMA-2025-05037RLUA-2026-01345

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks hubmabels-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database