Which versions of postinstall-logger-7x9z are malicious?

The following npm versions of postinstall-logger-7x9z are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate postinstall-logger-7x9z if I installed it?

postinstall-logger-7x9z is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed postinstall-logger-7x9z — how do I know if it already compromised me?

If postinstall-logger-7x9z was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is postinstall-logger-7x9z part of a known attack campaign?

Yes — postinstall-logger-7x9z is associated with the IN-MAL-2026-006339, IN-MAL-2026-006340, GHSA-j5hw-j4vj-f38v campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find postinstall-logger-7x9z across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for postinstall-logger-7x9z (version 1.0.0).

Malicious package

postinstall-logger-7x9znpm

Advisory published Jun 13, 2026Updated Jun 18, 2026

postinstall-logger-7x9z is a confirmed malicious npm package (MAL-2026-5738) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in postinstall-logger-7x9z (npm)

MAL-2026-5738

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall postinstall-logger-7x9z

What this malware does

On install, package.json's postinstall hook ("postinstall": "node run.js") triggers execution of bundled beacon scripts (beacon15.js and beacon_linux.js). These scripts pull in child_process, os, and http modules and issue outbound HTTP GET/POST requests carrying host identifiers including os.hostname() and os.platform(). The combination of automatic execution at install time, host-information collection, and outbound HTTP requests to a hardcoded destination is the canonical install-time exfiltration beacon shape. Any developer or CI system running npm install for this package will silently leak host data and execute code from the bundled scripts under the installing user's privileges.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

6e89b603ffc718873a9d4c42167bf0c667c995cc2547bc9b99373ad4e9f0ca1e

7bd01e5566ec604864f993b9387139fdf2145f9f9ffbb9a255e1a9947441a454

e91d5c0b2a31907feedaf2f7c1e590bf3a18e7315f534c41cb684bdafe8c6a4f

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for postinstall-logger-7x9z (version 1.0.0).
If you installed it — respond
postinstall-logger-7x9z is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If postinstall-logger-7x9z was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. postinstall-logger-7x9z on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-006339IN-MAL-2026-006340GHSA-j5hw-j4vj-f38v

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks postinstall-logger-7x9z-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database