syft-acp-corenpm
syft-acp-core is a confirmed malicious npm package (MAL-2026-10765) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 16.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in syft-acp-core (npm)
What this malware does
The syft-acp-core package was published to the npm registry by user 'ada8877' (maintainer email [email protected]) as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention (an ACP component library) of a target organization, so that a misconfigured resolver installs this public lookalike instead of the intended private dependency.
The package declares a preinstall hook ("npm install @sentry/node && node examples/verify.js") that executes automatically at npm install time, before any application code runs. The bundled examples/verify.js initializes the @sentry/node client against a hardcoded, attacker-controlled Sentry DSN with sendDefaultPii enabled, resolves the installing host's public egress IP address by requesting Cloudflare's /cdn-cgi/trace endpoint (using a spoofed desktop-browser User-Agent to bypass bot challenges), then deliberately triggers a runtime exception and captures it. Flushing the event beacons the collected host telemetry (public IP plus Sentry default PII such as hostname, OS username and runtime/environment metadata) to the attacker's Sentry ingest endpoint at o4510485815754752.ingest.us.sentry.io.
Each impersonated namespace in the campaign beacons to a distinct Sentry project ID, letting the operator attribute successful installs to specific victim organizations — behaviour consistent with a dependency-confusion reconnaissance beacon rather than legitimate error monitoring. The install-time payload is byte-for-byte identical to the earlier 'click2ai' campaign, sharing the same Sentry organization (o4510485815754752) and a related ProtonMail maintainer identity, and differs only in the package name and target DSN. This package's beacon targets Sentry project 4511744089718784.
package.json declares a preinstall hook npm install @sentry/node && node examples/verify.js that fires on every npm install. examples/verify.js resolves the installer's public IP via https://www.cloudflare.com/cdn-cgi/trace, attaches it as ip_address on a Sentry user, and captures a synthetic exception. The event is uploaded to a hardcoded DEFAULT_DSN pointing at Sentry org o4510485815754752.ingest.us.sentry.io/4511744089718784, which the installer did not configure. src/index.js additionally hardcodes the same DEFAULT_DSN as the library's default and forces sendDefaultPii: true, so consumers that call init() without supplying their own DSN or SENTRY_DSN environment variable send their captured errors and PII to the same author-controlled Sentry project instead of their own.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for syft-acp-core (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging syft-acp-core across your stack and pipelines.
If you installed it — respond
syft-acp-core is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If syft-acp-core was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks syft-acp-core before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- SafeDep · finder
Detect & block this
O3 blocks syft-acp-core-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.