What does the sn3akysnak3-test malware do?

The package sn3akysnak3-test was found to contain malicious code. The OpenSSF Package Analysis project identified 'sn3akysnak3-test' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

Which versions of sn3akysnak3-test are malicious?

The following npm versions of sn3akysnak3-test are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate sn3akysnak3-test if I installed it?

Remove sn3akysnak3-test from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed sn3akysnak3-test — how do I know if it already compromised me?

If sn3akysnak3-test was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

How do I find sn3akysnak3-test across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for sn3akysnak3-test (version 1.0.1).

Malicious package

sn3akysnak3-testnpm

Advisory published Mar 29, 2026Updated Mar 31, 2026

sn3akysnak3-test is a confirmed malicious npm package (MAL-2026-2286) that executes malicious code on install (malicious version 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in sn3akysnak3-test (npm)

MAL-2026-2286

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall sn3akysnak3-test

What this malware does

The package sn3akysnak3-test was found to contain malicious code.

The OpenSSF Package Analysis project identified 'sn3akysnak3-test' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

ad2dfd34d78a61b83986bd4ada87bf26d1b037bdad8bdd893f613052b27c2d3f

21fa246103030890351ed5948825f415a78600c6aacb5187dbd840518f744d92

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for sn3akysnak3-test (version 1.0.1).
If you installed it — respond
Remove sn3akysnak3-test from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If sn3akysnak3-test was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. sn3akysnak3-test on npm has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks sn3akysnak3-test-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database