NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

hunterone-build-probe-9210npm

Advisory published Updated

hunterone-build-probe-9210 is a confirmed malicious npm package (MAL-2026-14061) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1, 1.0.2…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in hunterone-build-probe-9210 (npm)

MAL-2026-14061
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall hunterone-build-probe-9210

What this malware does

probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it collects os.hostname(), os.platform(), os.networkInterfaces(), cwd, uid, the output of id, a full process.env dump, /proc/self/environ, a root filesystem listing, and the contents of ~/.npmrc, and specifically reads AWS_CONTAINER_CREDENTIALS_RELATIVE_URI. The collected JSON payload is POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/22508080-b099-4ec3-8ab7-7354af2886a9/buildenv. ~/.npmrc contains the installer's npm registry auth token, and the AWS ECS credential-endpoint variable exposes the path to fetch task-role AWS credentials; both are installer-owned secrets shipped to an anonymous third-party collector at install time.

Malicious versions

8 flagged
1.0.01.0.11.0.21.0.31.0.41.0.51.0.61.0.7

Indicators of compromise (SHA-256)

3ec98af6daa0ac779e19b9249ebfc0674e6b00926be73418af8568cf3ceb990c
e9836b18137c6fbd69c9649ea8bf98c1d6f775d29862b622ba71b4284dbc1c2a
f0a052c2ffbfbf2c3cb34252e725758a50453abe83d6c7584bf5d137da8a5b36
f9c474b248e3deb3b54338ed3e99a3922c225662bee7f969d0edc75ece636658
3f27c0ce93b98a1c9d602604eef2a625c6a7c2ebb7a1be38eeeaf06deb4e436e
4593a430d31b1354262bb20224ddcc167d2b274630a254f3cd6e656f7091ef10
578145e9754ef9bd5b0ec9f89d6de4a30d76c77ef8a92a91a8dc88b128583388
ae782a832d1741014f48e5944b8b6746ab02eb030b27e67dac2458ab3e6ba9ad

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for hunterone-build-probe-9210 (8 malicious versions).

  2. If you installed it — respond

    hunterone-build-probe-9210 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If hunterone-build-probe-9210 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. hunterone-build-probe-9210 on npm has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017952IN-MAL-2026-017948IN-MAL-2026-017954IN-MAL-2026-017947IN-MAL-2026-017951IN-MAL-2026-017953IN-MAL-2026-017950IN-MAL-2026-017949

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks hunterone-build-probe-9210-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
hunterone-build-probe-9210 (npm) malicious package — MAL-2026-14061 | O3 Security