What does the rank253222 malware do?

The package rank253222 was found to contain malicious code. The OpenSSF Package Analysis project identified 'rank253222' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

Which versions of rank253222 are malicious?

The following npm versions of rank253222 are flagged malicious: 1.0.0, 1.0.1, 1.0.6, 1.0.8. Treat any of these as compromised.

How do I remediate rank253222 if I installed it?

Remove rank253222 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed rank253222 — how do I know if it already compromised me?

If rank253222 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

How do I find rank253222 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for rank253222 (4 malicious versions).

Malicious package

rank253222npm

Advisory published Jan 22, 2026Updated Jan 23, 2026

rank253222 is a confirmed malicious npm package (MAL-2026-448) that executes malicious code on install (malicious versions 1.0.0, 1.0.1, 1.0.6…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in rank253222 (npm)

MAL-2026-448

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall rank253222

What this malware does

The package rank253222 was found to contain malicious code.

The OpenSSF Package Analysis project identified 'rank253222' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Malicious versions

4 flagged

1.0.01.0.11.0.61.0.8

Indicators of compromise (SHA-256)

1144fbc4237182c8daebd781f34df7ec24e61f4c826e481dbfa9d7b0bffaeabe

d14b07e8aa625cbb0133786a7ecd3fc6557ef16fb1a60d95122597ad48bb1bbf

600ee373e6755a5883fe737f3cab5f059ed62afb0eece28a10da54986ceebf29

72ac3aea2ea8c56c4c573f747f6d1105a22a3f4165bf43cc02f445fba86b9401

b5018dad195b0f107123f1ab9240ebe4944cd08688982be0c2e9c6203ba9cff1

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for rank253222 (4 malicious versions).
If you installed it — respond
Remove rank253222 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If rank253222 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. rank253222 on npm has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.6, 1.0.8 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks rank253222-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database