NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

r17d-sec-research-markernpm

Advisory published Updated

r17d-sec-research-marker is a confirmed malicious npm package (MAL-2026-19227) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in r17d-sec-research-marker (npm)

MAL-2026-19227
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall r17d-sec-research-marker

What this malware does

On npm install, the package's postinstall script (collect.js) runs shell listings of the home directory and current working directory, probes for the presence of installer credential/config files (~/.npmrc, ~/.gitconfig, ~/.config/gh, ~/.novus), enumerates all process.env variable names, and POSTs the collected JSON to a hardcoded anonymous inspection endpoint at webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61. The host reconnaissance includes the output of whoami, OS/kernel info, home-directory listing, dotfile presence inventory, and the full environment variable name list — a dataset that reveals CI provider, cloud credential presence, and secret-store usage, suitable for follow-on credential targeting. The script's self-label as a 'security research POC collecting metadata only' does not change the behavior: the installer did not opt in, the destination is an anonymous third-party collector, and the presence inventory of credential paths is itself exfiltration.

Malicious versions

1 flagged
1.0.0

Indicators of compromise (SHA-256)

0dbf3def098b1620e001e0831b405dd03ec20787a88a28892163cdfbe2eadbee

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for r17d-sec-research-marker (version 1.0.0).

  2. If you installed it — respond

    r17d-sec-research-marker is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If r17d-sec-research-marker was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. r17d-sec-research-marker on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-022770

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks r17d-sec-research-marker-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
r17d-sec-research-marker (npm) malicious package — MAL-2026-19227 | O3 Security