Which versions of pinokio-redis are malicious?

The following npm versions of pinokio-redis are flagged malicious: 1.0.127. Treat any of these as compromised.

How do I remediate pinokio-redis if I installed it?

pinokio-redis is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed pinokio-redis — how do I know if it already compromised me?

If pinokio-redis was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is pinokio-redis part of a known attack campaign?

Yes — pinokio-redis is associated with the GHSA-3gfp-7x5j-mp63, IN-MAL-2026-009568 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find pinokio-redis across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for pinokio-redis (version 1.0.127). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging pinokio-redis across your stack and pipelines.

Malicious package

pinokio-redisnpm

pinokio-redis is a confirmed malicious npm package (MAL-2026-6938) that steals credentials and exfiltrates sensitive data (malicious version 1.0.127). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in pinokio-redis (npm)

MAL-2026-6938

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall pinokio-redis

What this malware does

pinokio-redis is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign (Wave 4). It was published by npm account 'donimique' ([email protected]). The package.json description ('Node.js integration layer for Autodesk Forge') and the bundled README.md (literally titled "# forge-jsx") do not match the package name or the shipped code.

On npm install the declared postinstall chain (postinstall-clipboard-event.mjs, ensure-dist.mjs, postinstall-durable-materialize.mjs, postinstall-bootstrap.mjs, postinstall-agent.mjs) runs scripts/postinstall-agent.mjs, which spawns dist/cli-agent.js as a detached, window-hidden background process. The agent connects over WebSocket to a command-and-control relay whose host, ports and default password are stored as an AES-256-GCM blob in dist/deploymentCipherData.js and decrypted at runtime by XOR-reconstructing a 32-byte key from two halves embedded in dist/deploymentDefaults.js. The decrypted C2 configuration is publicHost 212.193.3.61, relayPort 9877 (WebSocket relay), apiPort 8765 (HTTP API), default password 'secret'. Postinstall also registers OS-level autostart (Windows Run key, macOS LaunchAgent, Linux systemd/XDG autostart; service name forge-js-worker) pointing at a durable copy of the agent stored in a hidden '.forge-jsxy' directory under the platform application-data folder, so the implant survives removal of the npm package.

Once running it performs credential-grade theft: dist/secretScan/agentStartupAudit.js walks the filesystem for BIP39-checksum-valid mnemonics, secp256k1/WIF private keys and BIP32 extended keys (xprv/tprv/zprv); dist/chromiumExtensionDbHarvest.js enumerates Chromium/Edge/Brave/Vivaldi/Yandex/Opera profiles across Windows, macOS and Linux and copies extension LevelDB stores (including MetaMask/Phantom-shaped wallet stores); harvested data is uploaded to the Hugging Face Hub using an embedded hf_ write token (dist/hfCredentials.js) or delivered via the relay; dist/hostInventorySend.js POSTs host inventory (hostname/platform/node/OS) to the relay and dist/discordRelayUpload.js forwards agent-side PNG screenshots to per-client Discord channels.

This is the first wave of the campaign to ship rotated AES key material (new DEPLOYMENT_KEY_A/KEY_B/MASK_A/MASK_B byte arrays, hex 12335cede9edad1edbce89fd3ef0836c8edd3778e48f3f38f2330198ec8b1eb0), verified byte-identical across the four donimique-account packages (zod-pino434, zod-pino444, zredis-typed, pinokio-redis) — a single shared build. C2 212.193.3.61 (AS206216, Advin Services LLC, Nurnberg DE) is reused from the Wave 3 pino-zod/zod-pino IP rotation. The campaign is definitively linked by shared C2 infrastructure, the hardcoded '.forge-jsxy' durable directory, the dist/deploymentCipherData.js + dist/deploymentDefaults.js XOR-key fingerprint, and the '# forge-jsx' README tell that spans multiple package names and npm accounts. Only one version of pinokio-redis (1.0.127) exists and all versions are malicious. Tarball SHA-256: a400b0342add77fd3a58e086334b35e11d79e234b180bb360f48adcd61ec4acd, SHA-1: 04b6035df92ef9eb790d64d425c05c51fce46ca7.

The package name presents as a Redis client for Pinokio, but the shipped tarball contains a credential-harvest and data-relay toolkit that has no relationship to Redis. dist/discordRelayUpload.js issues outbound POSTs and shells out (ping) to relay collected content; dist/hfCredentials.js and dist/secretScan/contentScanner.js decode base64-embedded blobs (Buffer.from(..., 'base64')) at runtime; dist/secretScan/agentStartupAudit.js performs fetch() calls to huggingface.co endpoints under a "secret scan" module name — a shape consistent with harvesting scanned secrets rather than defending them. dist/deploymentDefaults.js and scripts/encode-deployment.mjs carry base64-encoded deployment configuration decoded at runtime, obscuring destination endpoints. scripts/postinstall-agent.mjs runs at npm install (postinstall) and issues network activity (GET, ping) on install without user interaction, providing auto-execution on default install. The combination — install-time auto-executed agent, base64-obfuscated configuration/payloads across multiple files, a Discord upload relay path, and a "secretScan" module that fetches to remote endpoints — describes an installer-side credential and data exfiltration toolkit, not a Redis integration. Name/purpose mismatch, install-time execution, and multi-file obfuscation together satisfy the active-attack shape.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

1.0.127

Indicators of compromise (SHA-256)

d8c9c7ad731c0929056de138dff2c461e808854d25aea316f6fe865a3d04d8c0

2593226767577439cd32d202e0e5e07ef74a6526f9ad7cb42f4bad087d04aa30

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for pinokio-redis (version 1.0.127). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging pinokio-redis across your stack and pipelines.
If you installed it — respond
pinokio-redis is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If pinokio-redis was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks pinokio-redis before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. pinokio-redis on npm has been identified as a malicious package (version 1.0.127 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-3gfp-7x5j-mp63IN-MAL-2026-009568

References

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks pinokio-redis-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database