Which versions of preferenceslifecycle-paypal are malicious?

The following npm versions of preferenceslifecycle-paypal are flagged malicious: 24.0.0, 28.0.0. Treat any of these as compromised.

How do I remediate preferenceslifecycle-paypal if I installed it?

preferenceslifecycle-paypal establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed preferenceslifecycle-paypal — how do I know if it already compromised me?

If preferenceslifecycle-paypal was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is preferenceslifecycle-paypal part of a known attack campaign?

Yes — preferenceslifecycle-paypal is associated with the GHSA-jpjh-7qpg-hqxv, IN-MAL-2026-011250, IN-MAL-2026-013284 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find preferenceslifecycle-paypal across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for preferenceslifecycle-paypal (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging preferenceslifecycle-paypal across your stack and pipelines.

Malicious package

preferenceslifecycle-paypalnpm

preferenceslifecycle-paypal is a confirmed malicious npm package (MAL-2026-11062) that opens a backdoor for remote access (malicious versions 24.0.0, 28.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in preferenceslifecycle-paypal (npm)

MAL-2026-11062

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall preferenceslifecycle-paypal

What this malware does

The package's preinstall hook executes index.js, which collects host identifiers (os.hostname(), os.platform(), os.arch(), os.homedir(), and dns.getServers()) and POSTs them as JSON to the hardcoded host ucahu2x3m2osjmwim8n8vmn1ssykmnac.oastify.com (a Burp Collaborator out-of-band domain) at /hit. The transmission is unconditional and fires automatically on npm install without any documented purpose or opt-in. The package name resembles internal-package/scope conventions, matching a dependency-confusion beaconing pattern where install-time execution confirms resolution of an attacker-published lookalike inside a target environment.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The OpenSSF Package Analysis project identified 'preferenceslifecycle-paypal' @ 28.0.0 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

2 flagged

24.0.028.0.0

Indicators of compromise (SHA-256)

14f6d8ebd40b7b46436b5f7fb622b770e061258ffa89d74fec858f27eb6a5327

8741695d3ce21420a88f903f03c16da4621561d07117127b656f91488c9b58f5

e33d1db03ba9b9f1d9dc9f4c81a574e5baa69549e6c1897230540fe15d2749a3

47276cd75e9a5204e108bbd3603a358cd2e1e6253b133a09fcd524de3547d0f1

Detection & response playbook

Backdoor / remote access

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for preferenceslifecycle-paypal (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging preferenceslifecycle-paypal across your stack and pipelines.
If you installed it — respond
preferenceslifecycle-paypal establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If preferenceslifecycle-paypal was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks preferenceslifecycle-paypal before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. preferenceslifecycle-paypal on npm has been identified as a malicious package (versions 24.0.0, 28.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-jpjh-7qpg-hqxvIN-MAL-2026-011250IN-MAL-2026-013284

References

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks preferenceslifecycle-paypal-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database