Which versions of swap-sdk-87 are malicious?

The following npm versions of swap-sdk-87 are flagged malicious: 4.63.78. Treat any of these as compromised.

How do I remediate swap-sdk-87 if I installed it?

swap-sdk-87 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed swap-sdk-87 — how do I know if it already compromised me?

If swap-sdk-87 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is swap-sdk-87 part of a known attack campaign?

Yes — swap-sdk-87 is associated with the IN-MAL-2026-005349 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find swap-sdk-87 across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for swap-sdk-87 (version 4.63.78). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging swap-sdk-87 across your stack and pipelines.

Malicious package

swap-sdk-87npm

Malicious code in swap-sdk-87 (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-5359

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall swap-sdk-87

What this malware does

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling (c960+). postinstall auto-execs, src/index.js harvests ~/.ssh keys + Sol/Eth/BTC/Tron/Sui/Aptos wallets + .env + seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 (not rotated). Inflated version.

On npm install, the package's postinstall hook loads src/index.js, which after a 4-second delay and a sandbox/CI-evasion gate enumerates installer-side secrets and uploads them to an attacker-controlled Telegram bot. Targeted paths include ~/.ssh/id_rsa, ~/.ssh/id_ed25519, Solana keypair (~/.config/solana/id.json), Ethereum/Bitcoin/Tron/Sui/Aptos wallet files, .env files, and mnemonic/seed/keystore/secrets files. Stolen contents are POSTed to api.telegram.org/bot<redacted>/sendDocument with chat_id 6433587894. The bot token 8227918239:AAGEMDrBZluDsBBYPxfSyMuv2l3FY8cZCcs is hardcoded at src/index.js line 6. The code self-identifies with the literal HTML header CRYPTO STEALER (src/index.js line 107). An evasion routine isTestEnvironment() (src/index.js lines 10–22) suppresses payload execution when CI=true, GITHUB_ACTIONS=true, JENKINS_HOME is set, NODE_ENV is test/development, the hostname matches sandbox/test/ci or a 12-hex docker pattern, or the username contains runner/sandbox/docker — designed to fire only on real developer machines. The package advertises itself as 'Core utilities for blockchain development' with web3/solana/ethereum keywords and a placeholder author 'John Miller', a lure aimed precisely at the crypto-developer population whose machines hold the targeted secrets. The package ships no actual SDK functionality.

Malicious versions

1 flagged

4.63.78

Indicators of compromise (SHA-256)

ee4f0ee119ae0ba917865c71f333eaeda049ce99024c50ad7d6c3ce41c1f7005

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for swap-sdk-87 (version 4.63.78). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging swap-sdk-87 across your stack and pipelines.
If you installed it — respond
swap-sdk-87 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If swap-sdk-87 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks swap-sdk-87 before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. swap-sdk-87 on npm has been identified as a malicious package (version 4.63.78 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005349

References

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks swap-sdk-87-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring