Which versions of moustick are malicious?

The following npm versions of moustick are flagged malicious: 1.2.1, 1.2.2. Treat any of these as compromised.

How do I remediate moustick if I installed it?

moustick is a typosquat — you almost certainly intended a legitimately-named package. Remove moustick, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed moustick — how do I know if it already compromised me?

If moustick was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is moustick part of a known attack campaign?

Yes — moustick is associated with the GHSA-979m-vm48-369f, IN-MAL-2026-005850, IN-MAL-2026-005851 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find moustick across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for moustick (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging moustick across your stack and pipelines.

Malicious package

mousticknpm

Malicious code in moustick (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5347

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall moustick

What this malware does

Package impersonates the popular cookie-signature library — it copies the description, README, author (TJ Holowaychuk), and repository URL of visionmedia/node-cookie-signature in package.json, while the package itself is published under the unrelated name moustick. On require('moustick'), index.js performs an HTTPS GET to https://www.jsonkeeper.com/b/MYUKZ (an anonymous, mutable paste host) and passes the response field content_o directly to eval(), executing whatever JavaScript the paste currently serves in the consumer's Node process. A helper function g(h) hex-decodes identifiers and assembles a second paste URL https://www.jsonkeeper.com/b/HY6M6 (hl decodes to ['axios','get','https://www.jsonkeeper.com/b/HY6M6','then']), providing a second remote-fetch primitive and confirming intentional evasion. Any developer who installs this package expecting cookie-signing functionality executes attacker-controlled code at import time; the operator can swap the paste contents at any time to deliver new payloads.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

2 flagged

1.2.11.2.2

Indicators of compromise (SHA-256)

890180372ad21984cf864d1d144734f47f696379213ef6e7bdf02a4c1f186a7f

d4e7fe7f047142ec8657563d0ea8b49e4fa254a22d27d7015c28317e79235ac8

deae034e46d94eafe1db97a6a57a664400f03caa48af8f775f6064c361c6bb9a

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for moustick (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging moustick across your stack and pipelines.
If you installed it — respond
moustick is a typosquat — you almost certainly intended a legitimately-named package. Remove moustick, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If moustick was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks moustick before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. moustick on npm has been identified as a malicious package (versions 1.2.1, 1.2.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-979m-vm48-369fIN-MAL-2026-005850IN-MAL-2026-005851

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks moustick-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring