Which versions of pay-methods-kmf are malicious?

The following npm versions of pay-methods-kmf are flagged malicious: 100.100.100, 100.100.101, 100.100.102. Treat any of these as compromised.

How do I remediate pay-methods-kmf if I installed it?

pay-methods-kmf is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed pay-methods-kmf — how do I know if it already compromised me?

If pay-methods-kmf was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is pay-methods-kmf part of a known attack campaign?

Yes — pay-methods-kmf is associated with the IN-MAL-2026-021396, IN-MAL-2026-021420, IN-MAL-2026-021419 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find pay-methods-kmf across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for pay-methods-kmf (3 malicious versions).

Malicious package

pay-methods-kmfnpm

Advisory published Oct 11, 2026Updated Oct 11, 2026

pay-methods-kmf is a confirmed malicious npm package (MAL-2026-17776) that steals credentials and exfiltrates sensitive data (malicious versions 100.100.100, 100.100.101, 100.100.102). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in pay-methods-kmf (npm)

MAL-2026-17776

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall pay-methods-kmf

What this malware does

[email protected] is a trivial stub (empty index.js, manifest description 'Frontend utilities') that ships a prebuilt Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it from postinstall.js via require('./prebuilds/linux-x64/addon.node'). On install the postinstall path performs two concurrent exfiltration channels: (1) a DNS beacon that resolves a subdomain of the form <hostname>.<packagename>.db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me against an interactsh/OAST collector, encoding the installer hostname and package name into the DNS label; and (2) the native addon calls gethostname, getpwuid, and getenv and issues an HTTP POST to the hardcoded bare IPv4 endpoint http://64.181.165.115/dc with body shape 'h=<hostname>&u=<user>&p=<package>&r=<npm_config_registry>', leaking the installer's hostname, username, package name, and configured npm registry URL (which may reveal internal/private registry hosts). The package ships no source for the binary, the compiled addon's symbol set (socket/connect/send/fork) is unrelated to any frontend utility, and both the OAST subdomain and the bare-IP POST endpoint are attacker-controlled infrastructure. Dependency-confusion-style version (100.100.102) and the registry-URL field in the exfil payload are consistent with internal-registry reconnaissance.

Malicious versions

3 flagged

100.100.100100.100.101100.100.102

Indicators of compromise (SHA-256)

07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2

d83e40860a0d1540222f76bb58c3dfc3f12e6258aff42d6f8eff747bcdf28c5c

f7a8a051b1961e3062a37b8ff1a9eb05025dc475bf1a5c694df49f0c90349c70

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for pay-methods-kmf (3 malicious versions).
If you installed it — respond
pay-methods-kmf is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If pay-methods-kmf was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. pay-methods-kmf on npm has been identified as a malicious package (versions 100.100.100, 100.100.101, 100.100.102 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021396IN-MAL-2026-021420IN-MAL-2026-021419

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks pay-methods-kmf-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database