Which versions of kmf-i18n are malicious?

The following npm versions of kmf-i18n are flagged malicious: 100.100.100, 100.100.101, 100.100.102. Treat any of these as compromised.

How do I remediate kmf-i18n if I installed it?

kmf-i18n is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed kmf-i18n — how do I know if it already compromised me?

If kmf-i18n was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is kmf-i18n part of a known attack campaign?

Yes — kmf-i18n is associated with the IN-MAL-2026-021418, IN-MAL-2026-021416, IN-MAL-2026-021425 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find kmf-i18n across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for kmf-i18n (3 malicious versions).

Malicious package

kmf-i18nnpm

Advisory published Oct 9, 2026Updated Oct 11, 2026

kmf-i18n is a confirmed malicious npm package (MAL-2026-17747) that steals credentials and exfiltrates sensitive data (malicious versions 100.100.100, 100.100.101, 100.100.102). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in kmf-i18n (npm)

MAL-2026-17747

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall kmf-i18n

What this malware does

[email protected] is published with the version-number and behavior shape of a dependency-confusion reconnaissance beacon rather than an i18n library. The tarball ships a Linux x64 N-API binary at prebuilds/linux-x64/addon.node with no corresponding source, no binding.gyp, and no build step. package.json declares scripts.postinstall = "node postinstall.js", and postinstall.js require()s that prebuilt.node binary, so the native code is loaded automatically on npm install. The addon opens a raw TCP socket to the hardcoded bare IP 64.181.165.115 on port 80 and sends an HTTP/1.0 POST to /dc with body h=<HOSTNAME>&p=<npm_package_name>&u=<unused>&r=<npm_config_registry>, reading those values from the installer's environment. The exfiltrated npm_config_registry value discloses internal/private npm registry URLs, which is the characteristic signal of dependency-confusion target reconnaissance. The addon exposes no i18n functionality consistent with the package's declared purpose; its only observable behavior is the install-time beacon. The main entry also require()s the same binary, so merely importing the package re-triggers the native load path.

The OpenSSF Package Analysis project identified 'kmf-i18n' @ 100.100.102 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

3 flagged

100.100.100100.100.101100.100.102

Indicators of compromise (SHA-256)

c506e33bdce28606141b7d2bbebbae50e97e466ab04664a9cca8fa48a3622ae1

6ea0a9b64d2c7100bfc55c2849fc7b51fe7c967850bfc5a17a0295a4bbfa85c7

b0331a73dd7ea6088c8c63d37751490d0834a305d6a7ddb6cd55de2e0741ff3e

ce04d25dced1e4c2398d7d91568783b983f326444098ecff8ddf7c29468d752c

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for kmf-i18n (3 malicious versions).
If you installed it — respond
kmf-i18n is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If kmf-i18n was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. kmf-i18n on npm has been identified as a malicious package (versions 100.100.100, 100.100.101, 100.100.102 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021418IN-MAL-2026-021416IN-MAL-2026-021425

References

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks kmf-i18n-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database