Which versions of identityauthorizationserv are malicious?

The following npm versions of identityauthorizationserv are flagged malicious: 21.0.0, 28.0.0. Treat any of these as compromised.

How do I remediate identityauthorizationserv if I installed it?

identityauthorizationserv is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed identityauthorizationserv — how do I know if it already compromised me?

If identityauthorizationserv was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is identityauthorizationserv part of a known attack campaign?

Yes — identityauthorizationserv is associated with the GHSA-gxvc-xwj7-xghw, IN-MAL-2026-011266, IN-MAL-2026-013293 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find identityauthorizationserv across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for identityauthorizationserv (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging identityauthorizationserv across your stack and pipelines.

Malicious package

identityauthorizationservnpm

identityauthorizationserv is a confirmed malicious npm package (MAL-2026-11100) that steals credentials and exfiltrates sensitive data (malicious versions 21.0.0, 28.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in identityauthorizationserv (npm)

MAL-2026-11100

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall identityauthorizationserv

What this malware does

[email protected] wires scripts.preinstall to node index.js, so on npm install the package auto-executes code that collects host reconnaissance data (os.hostname(), os.platform(), os.arch(), os.homedir(), and dns.getServers()) and POSTs it to a hardcoded out-of-band callback host at lwl8ethu6t8j3dg96z7zfd7scjib68ux.oastify.com/hit. oastify.com is Burp Collaborator infrastructure used for OOB exfiltration in dependency-confusion probes; the destination is attacker-controlled and unrelated to any legitimate publisher. The package self-describes as a dependency-confusion proof of concept, and the name pattern is consistent with a squat targeting an internal package name.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

2 flagged

21.0.028.0.0

Indicators of compromise (SHA-256)

ef1d43e872519f6b1865d149c6f202e9079165bc28c12645e8154155d61e7455

ca4808d7fab80b2202538cad6c5a1be4d62eb973ac35eb3a431fdf33f68b67ee

978daf7eea994a731d3a9acbc785bc587e64efcf3828fa7c80cb6d19e171d8f0

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for identityauthorizationserv (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging identityauthorizationserv across your stack and pipelines.
If you installed it — respond
identityauthorizationserv is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If identityauthorizationserv was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks identityauthorizationserv before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. identityauthorizationserv on npm has been identified as a malicious package (versions 21.0.0, 28.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-gxvc-xwj7-xghwIN-MAL-2026-011266IN-MAL-2026-013293

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks identityauthorizationserv-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database