Which versions of hwi-lib are malicious?

The following npm versions of hwi-lib are flagged malicious: 1.0.0, 1.0.1, 1.0.2. Treat any of these as compromised.

How do I remediate hwi-lib if I installed it?

hwi-lib is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed hwi-lib — how do I know if it already compromised me?

If hwi-lib was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is hwi-lib part of a known attack campaign?

Yes — hwi-lib is associated with the IN-MAL-2026-013413, IN-MAL-2026-013407, IN-MAL-2026-013430 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find hwi-lib across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for hwi-lib (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging hwi-lib across your stack and pipelines.

Malicious package

hwi-libnpm

hwi-lib is a confirmed malicious npm package (MAL-2026-12067) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1, 1.0.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in hwi-lib (npm)

MAL-2026-12067

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall hwi-lib

What this malware does

[email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files (~/.aws/credentials, ~/.ssh/id_rsa, id_ed25519, id_ecdsa, ~/.npmrc, ~/.gitconfig, ~/.config/solana/id.json, ~/.ethereum/keystore,.env variants) and walks hidden subdirectories of the user's home directory reading any file matching wallet|key|secret|seed|mnemonic|keystore|private or ending in.json/.pem/.key. The collected contents are POSTed via https.request to the hardcoded endpoint https://enxhcjpo5ev.x.pipedream.net/c. Package name and 'crypto utility' description impersonate the HWI (Hardware Wallet Interface) tooling while the shipped module exports nothing, indicating a lure.

The OpenSSF Package Analysis project identified 'hwi-lib' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

3 flagged

1.0.01.0.11.0.2

Indicators of compromise (SHA-256)

b354ab4fac90ce3cb0a5afb1a00d518a9a44e8a4da73e66845415e69ec620973

b384001368ca7ec877e30cd38551e5a8d27c7cb5802d745c8635e1988777ed6e

687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db

9811fc912ded9092f6b545a1e36c81b4f763c31fb141de0cb6c8fb22d4b6e54e

f631ccb5df4527d7ed8233bbd74a7973d492949f7f547177aa057e126d3c365f

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for hwi-lib (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging hwi-lib across your stack and pipelines.
If you installed it — respond
hwi-lib is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If hwi-lib was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks hwi-lib before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. hwi-lib on npm has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-013413IN-MAL-2026-013407IN-MAL-2026-013430

References

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks hwi-lib-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database