order-package-saasnpm
Advisory published Updated
order-package-saas is a confirmed malicious npm package (MAL-2026-15816) that steals credentials and exfiltrates sensitive data (malicious versions 999.0.0, 999.0.1). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in order-package-saas (npm)
What this malware does
The package's postinstall hook executes index.js, which sweeps installer-owned secrets from the home directory (.npmrc,.yarnrc,.gitconfig,.git-credentials, ~/.ssh/* private keys, ~/.aws/credentials and SSO cache, GCP application_default_credentials, Azure tokens, kubeconfig, Docker config, Terraform credentials, GitHub CLI hosts, Heroku.netrc, Vercel/Netlify/Supabase/Firebase tokens, VSCode settings, PyPI/gem/cargo credentials) and enumerates process.env for values matching TOKEN/KEY/SECRET/PASSWORD patterns, including AI provider API keys. The collected data — together with hostname, username, platform, architecture, cwd and Node version — is base64-encoded and transmitted over HTTPS to api.telegram.org/bot<redacted>/sendMessage (chat_id 8607833954) and over HTTP to 2.26.82.63:8888/collect. Execution is gated to early-return when NODE_ENV=test, CI=true, JEST_WORKER_ID or VITEST are set, or /.dockerenv exists, and is delayed by a randomized 5–15 second sleep to evade sandbox and CI observation. The package name and 999.0.1 version are consistent with a dependency-confusion lure targeting an internal package.
The OpenSSF Package Analysis project identified 'order-package-saas' @ 999.0.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Search your lockfiles and build artifacts for order-package-saas (2 malicious versions).
If you installed it — respond
order-package-saas is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If order-package-saas was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- OpenSSF: Package Analysis · finder
Detect & block this
O3 blocks order-package-saas-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.