Which versions of shakti-platform are malicious?

The following npm versions of shakti-platform are flagged malicious: 96.87.33. Treat any of these as compromised.

How do I remediate shakti-platform if I installed it?

Remove shakti-platform from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed shakti-platform — how do I know if it already compromised me?

If shakti-platform was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is shakti-platform part of a known attack campaign?

Yes — shakti-platform is associated with the GHSA-hp2x-gx66-m7pf, RLMA-2025-05509, RLUA-2025-05945 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find shakti-platform across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for shakti-platform (version 96.87.33). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging shakti-platform across your stack and pipelines.

Malicious package

shakti-platformnpm

shakti-platform is a confirmed malicious npm package (MAL-2025-48297) that executes malicious code on install (malicious version 96.87.33). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in shakti-platform (npm)

MAL-2025-48297

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall shakti-platform

What this malware does

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

96.87.33

Indicators of compromise (SHA-256)

2ca52c026a7d362e8dcd8046f9322539ce61e40b0508440b211d2ac62ae0889e

79cf54595bf3e1bca8a5441e91434ac41172226f135c32bbe7ff3a7750cc8f7b

77ffff9ddfb63c8513f955326ef2f97efe97897bde533318b09d6361df584b49

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for shakti-platform (version 96.87.33). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging shakti-platform across your stack and pipelines.
If you installed it — respond
Remove shakti-platform from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If shakti-platform was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks shakti-platform before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. shakti-platform on npm has been identified as a malicious package (version 96.87.33 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-hp2x-gx66-m7pfRLMA-2025-05509RLUA-2025-05945

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks shakti-platform-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database