Which versions of microsoft-employee-experience are malicious?

The following npm versions of microsoft-employee-experience are flagged malicious: 99.2.1, 99.2.2. Treat any of these as compromised.

How do I remediate microsoft-employee-experience if I installed it?

Remove microsoft-employee-experience from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed microsoft-employee-experience — how do I know if it already compromised me?

If microsoft-employee-experience was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

How do I find microsoft-employee-experience across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for microsoft-employee-experience (2 malicious versions).

Malicious package

microsoft-employee-experiencenpm

Advisory published Apr 23, 2026Updated Apr 24, 2026

microsoft-employee-experience is a confirmed malicious npm package (MAL-2026-3018) that executes malicious code on install (malicious versions 99.2.1, 99.2.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in microsoft-employee-experience (npm)

MAL-2026-3018

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall microsoft-employee-experience

What this malware does

The package microsoft-employee-experience was found to contain malicious code.

The OpenSSF Package Analysis project identified 'microsoft-employee-experience' @ 99.2.2 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Malicious versions

2 flagged

99.2.199.2.2

Indicators of compromise (SHA-256)

57f04f03ea7885020c55b905296876100e081e865b6abc6d6a7b3c03786a8d98

9c34bc4b2b8497b2f155f93295b0fe4b78eb94e7830684929547465d0b66b7a7

141a7384b8f01b0eff88e3a189bdec1d19e05dd5ee23caf3b2c7d1a92f1c290f

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for microsoft-employee-experience (2 malicious versions).
If you installed it — respond
Remove microsoft-employee-experience from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If microsoft-employee-experience was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. microsoft-employee-experience on npm has been identified as a malicious package (versions 99.2.1, 99.2.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks microsoft-employee-experience-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database