Which versions of ssr-catalogue-sfcc are malicious?

The following npm versions of ssr-catalogue-sfcc are flagged malicious: 99.99.4. Treat any of these as compromised.

How do I remediate ssr-catalogue-sfcc if I installed it?

Remove ssr-catalogue-sfcc from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed ssr-catalogue-sfcc — how do I know if it already compromised me?

If ssr-catalogue-sfcc was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is ssr-catalogue-sfcc part of a known attack campaign?

Yes — ssr-catalogue-sfcc is associated with the RLMA-2026-01819 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find ssr-catalogue-sfcc across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for ssr-catalogue-sfcc (version 99.99.4).

Malicious package

ssr-catalogue-sfccnpm

Advisory published Mar 24, 2026Updated Apr 7, 2026

ssr-catalogue-sfcc is a confirmed malicious npm package (MAL-2026-2391) that executes malicious code on install (malicious version 99.99.4). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in ssr-catalogue-sfcc (npm)

MAL-2026-2391

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall ssr-catalogue-sfcc

What this malware does

The package ssr-catalogue-sfcc was found to contain malicious code.

Malicious versions

1 flagged

99.99.4

Indicators of compromise (SHA-256)

d4429ddfe92acbedf6ffee96dd7d964352eab0e209dd0fbb4f613c5ed545fd5f

3ffd2663232d7c5508f63c063736d09a7c1fdfefe9783f5941c9214f687df7fb

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for ssr-catalogue-sfcc (version 99.99.4).
If you installed it — respond
Remove ssr-catalogue-sfcc from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If ssr-catalogue-sfcc was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. ssr-catalogue-sfcc on npm has been identified as a malicious package (version 99.99.4 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-01819

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks ssr-catalogue-sfcc-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database