Which versions of rony-test are malicious?

The following npm versions of rony-test are flagged malicious: 99.9.9. Treat any of these as compromised.

How do I remediate rony-test if I installed it?

rony-test is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed rony-test — how do I know if it already compromised me?

If rony-test was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is rony-test part of a known attack campaign?

Yes — rony-test is associated with the IN-MAL-2026-008100 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find rony-test across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for rony-test (version 99.9.9). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging rony-test across your stack and pipelines.

Malicious package

rony-testnpm

Malicious code in rony-test (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-7001

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall rony-test

What this malware does

The package's main entry (index.js) collects installer identity data — os.userInfo().username, process.env.INIT_CWD || process.cwd(), and os.hostname() — and POSTs the JSON body to a hardcoded webhook.site endpoint (https://webhook.site/7088d897-5b86-4deb-8d29-5b7a263a49b4) at module load time via require('https'). Any consumer that requires or imports this package leaks host and user identifiers to an author-controlled third-party sink with no consent and no documented purpose (package description is 'Researching'). A postinstall entry ('node indes.js') references a non-existent file and would fail with MODULE_NOT_FOUND, so the install-time trigger is broken, but the load-time exfiltration via the main module is functional.

Malicious versions

1 flagged

99.9.9

Indicators of compromise (SHA-256)

873cd33646b64f2073cc37ed9649a3757fb8aa186d50f700cb8ad199196fd56c

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for rony-test (version 99.9.9). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging rony-test across your stack and pipelines.
If you installed it — respond
rony-test is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If rony-test was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks rony-test before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. rony-test on npm has been identified as a malicious package (version 99.9.9 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-008100

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks rony-test-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring