Which versions of o3forms are malicious?

The following npm versions of o3forms are flagged malicious: 90.0.0, 99.1.99. Treat any of these as compromised.

How do I remediate o3forms if I installed it?

o3forms is a typosquat — you almost certainly intended a legitimately-named package. Remove o3forms, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed o3forms — how do I know if it already compromised me?

If o3forms was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is o3forms part of a known attack campaign?

Yes — o3forms is associated with the IN-MAL-2026-005065, IN-MAL-2026-005159 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find o3forms across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for o3forms (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging o3forms across your stack and pipelines.

Malicious package

o3formsnpm

Malicious code in o3forms (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5450

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall o3forms

What this malware does

The package name impersonates the OpenMRS O3 forms ecosystem (legitimate packages are published under the @openmrs/ scope). package.json declares an optionalDependency o3forms-utils resolved as github:core-modules-lab/o3forms-utils#76c1c55 — code fetched directly from GitHub, outside npm registry scanning. index.js (lines 1-4) wraps require('o3forms-utils') in a try/catch that silently swallows errors, so the off-registry payload executes on every consumer import with no visible failure if anything goes wrong. The package.json bin field maps 11 ubiquitous dev-tool names (webpack, vite, eslint, tsc, next, jest, prettier, nodemon, turbo, ts-node, webpack-cli) all to index.js, so any hoisted invocation of those commands (e.g. npx webpack) launches this package's loader and triggers the GitHub fetch+execute. Additional attacker-hygiene tells: version 99.1.99 (version-squat to outrank legitimate releases), config.unsafe-perm: true to keep root during npm scripts, and a placeholder OpenMRS Community Contributor author with no homepage. Installing or loading this package — or running any of the hijacked dev-tool commands in a project where it is hoisted — executes attacker-controlled code from a mutable GitHub commit.

Malicious versions

2 flagged

90.0.099.1.99

Indicators of compromise (SHA-256)

4d094d4429f1492bb6b99d802de86b97dc972e06d680a1287846e6d1635fe457

aacfdf714651bb7a6ab33cec3a675e5031157ce336db3f60a800bd7dc0ae5daf

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for o3forms (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging o3forms across your stack and pipelines.
If you installed it — respond
o3forms is a typosquat — you almost certainly intended a legitimately-named package. Remove o3forms, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If o3forms was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks o3forms before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. o3forms on npm has been identified as a malicious package (versions 90.0.0, 99.1.99 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005065IN-MAL-2026-005159

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks o3forms-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring