Which versions of nextiva-partners-microsite are malicious?

The following npm versions of nextiva-partners-microsite are flagged malicious: 1.0.8, 2.0.0. Treat any of these as compromised.

How do I remediate nextiva-partners-microsite if I installed it?

Remove nextiva-partners-microsite from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed nextiva-partners-microsite — how do I know if it already compromised me?

If nextiva-partners-microsite was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is nextiva-partners-microsite part of a known attack campaign?

Yes — nextiva-partners-microsite is associated with the RLMA-2024-06957, RLUA-2026-01449 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find nextiva-partners-microsite across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for nextiva-partners-microsite (2 malicious versions).

Malicious package

nextiva-partners-micrositenpm

Advisory published Oct 16, 2024Updated Mar 19, 2026

nextiva-partners-microsite is a confirmed malicious npm package (MAL-2024-9726) that executes malicious code on install (malicious versions 1.0.8, 2.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in nextiva-partners-microsite (npm)

MAL-2024-9726

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall nextiva-partners-microsite

Malicious versions

2 flagged

1.0.82.0.0

Indicators of compromise (SHA-256)

b6688df5d2064bdc5942d80c4790482ea1095cf4ecce8723c76654284deb34d4

92b45b1401800ec8ac839d48c5d60ab5c6b75bab9dcf61a5222f2369596fec0f

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for nextiva-partners-microsite (2 malicious versions).
If you installed it — respond
Remove nextiva-partners-microsite from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If nextiva-partners-microsite was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. nextiva-partners-microsite on npm has been identified as a malicious package (versions 1.0.8, 2.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-06957RLUA-2026-01449

Credits

ReversingLabs · finder

Detect & block this

O3 blocks nextiva-partners-microsite-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database