Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

test-account-portal-fenpm

Advisory published Updated

test-account-portal-fe is a confirmed malicious npm package (MAL-2026-17748) that steals credentials and exfiltrates sensitive data (malicious versions 100.100.100, 100.100.101, 100.100.102). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in test-account-portal-fe (npm)

MAL-2026-17748
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall test-account-portal-fe

What this malware does

npm package [email protected] ships only a Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it unconditionally from index.js via require('./prebuilds/linux-x64/addon'). No C/C++ source, binding.gyp, prebuild URL, or checksum accompanies the binary, and the stated purpose ("Frontend utilities") has no need for a native addon. On NAPI module init the addon forks and opens a socket to the hardcoded bare IP 64.181.165.115, issuing POST /dc HTTP/1.0 with a body of the form h=<hostname>&u=<unix-user>&p=<npm_package_name>&r=<npm_config_registry>, exfiltrating the installer's host identity, local username, consuming package name, and configured npm registry URL. ELF strings and imports (socket/connect/send/gethostname/getpwuid/getenv, symbol try_connect) corroborate the beacon. The package name and implausibly high version (100.100.101) alongside a placeholder description are consistent with a dependency-confusion probe against an internal account-portal-fe package: exfiltrating npm_config_registry is precisely how such a probe confirms resolution against a private registry. Installing or requiring this package automatically leaks installer identity and internal registry configuration to attacker-controlled infrastructure.

The OpenSSF Package Analysis project identified 'test-account-portal-fe' @ 100.100.102 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

Malicious versions

3 flagged
100.100.100100.100.101100.100.102

Indicators of compromise (SHA-256)

5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907
63911c5f393d2276fffe11b7d465b04704722dc852a79fbfbd63b5f8dbd812b8
d9191f0c04c63fc8aa02af2a97681b15cfd241ead915ee30f0b79baa0c4e0200
0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for test-account-portal-fe (3 malicious versions).

  2. If you installed it — respond

    test-account-portal-fe is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If test-account-portal-fe was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. test-account-portal-fe on npm has been identified as a malicious package (versions 100.100.100, 100.100.101, 100.100.102 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021423IN-MAL-2026-021378IN-MAL-2026-021469

References

Credits

  • Amazon Inspector · finder
  • OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks test-account-portal-fe-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
test-account-portal-fe (npm) malicious package — MAL-2026-17748 | O3 Security