Which versions of notify-funcs are malicious?

The following npm versions of notify-funcs are flagged malicious: 1.3.5, 1.3.6. Treat any of these as compromised.

How do I remediate notify-funcs if I installed it?

notify-funcs is a typosquat — you almost certainly intended a legitimately-named package. Remove notify-funcs, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed notify-funcs — how do I know if it already compromised me?

If notify-funcs was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is notify-funcs part of a known attack campaign?

Yes — notify-funcs is associated with the IN-MAL-2026-009650, IN-MAL-2026-009652 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find notify-funcs across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for notify-funcs (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging notify-funcs across your stack and pipelines.

Malicious package

notify-funcsnpm

Malicious code in notify-funcs (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10155

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall notify-funcs

What this malware does

The package presents itself as a pino-compatible logging middleware (exports check as both default and pino named export) but its actual behavior on invocation is to spawn a detached Node child running lib/vcall.js, which fetches JavaScript from an IPFS gateway URL (https://emerald-accurate-urial-9.mypinata.cloud/ipfs/bafkreify2ijjvromekknzxzvqaopft6muwlpl37mvmpdeazwzzkbjzkuxm) and executes the response via new Function.constructor('require', src)(require), granting the remote payload full Node.js capabilities. The detached spawn is designed to survive parent exit. lib/const.js also ships base64-encoded strings (e.g. DEV_API_KEY decoding to https://jsonkeeper.com/b/ZK45J) referencing an anonymous paste-host endpoint consistent with additional staging. The logger-mimicking API surface and pino-shaped exports are a decoy for the remote-execution dropper: any consumer wiring this as Express middleware triggers arbitrary remote code execution on the host.

Malicious versions

2 flagged

1.3.51.3.6

Indicators of compromise (SHA-256)

05def872b3ba2e02e9967fef76ccc5fbc0d316c4cd23b26146e1c7902d54bf7e

9b65341bde476af6b80e1fbaa9f9a844b7fdc023ef02f5fabb88514d88012159

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for notify-funcs (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging notify-funcs across your stack and pipelines.
If you installed it — respond
notify-funcs is a typosquat — you almost certainly intended a legitimately-named package. Remove notify-funcs, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If notify-funcs was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks notify-funcs before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. notify-funcs on npm has been identified as a malicious package (versions 1.3.5, 1.3.6 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009650IN-MAL-2026-009652

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks notify-funcs-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring