Which versions of testing-d3do are malicious?

The following npm versions of testing-d3do are flagged malicious: 99.9.9. Treat any of these as compromised.

How do I remediate testing-d3do if I installed it?

Remove testing-d3do from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed testing-d3do — how do I know if it already compromised me?

If testing-d3do was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is testing-d3do part of a known attack campaign?

Yes — testing-d3do is associated with the IN-MAL-2026-009109 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find testing-d3do across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for testing-d3do (version 99.9.9). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging testing-d3do across your stack and pipelines.

Malicious package

testing-d3donpm

testing-d3do is a confirmed malicious npm package (MAL-2026-10006) that executes malicious code on install (malicious version 99.9.9). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in testing-d3do (npm)

MAL-2026-10006

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall testing-d3do

What this malware does

On npm install, this package's postinstall script collects host identifiers (os.hostname(), os.userInfo(), current working directory, and external IPv4 address) and POSTs them to a hardcoded subdomain under oast.fun (lpzlajzjfkpfeefuzxbv6n5nob7bpuh6e.oast.fun, path /receive-data). oast.fun is an Interactsh out-of-band collector commonly used for dependency-confusion reconnaissance. The package metadata is consistent with a dependency-confusion squat: name prefixed with 'testing-', version 99.9.9 (unrealistically high to win registry resolution against an internal package of the same short name), empty author/description/keywords. Installing this package causes the installer's machine identifiers and network address to be sent to a third-party collector controlled by whoever registered the OAST subdomain.

The OpenSSF Package Analysis project identified 'testing-d3do' @ 99.9.9 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

1 flagged

99.9.9

Indicators of compromise (SHA-256)

cbb133c89692a67e9aff0a4777c486d480852fb223a5ac9b7c983ae94cdceef6

6c008bcf9a72a02f11c556396a39d6de999bfad0cfa389ddac01929d19bb34d8

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for testing-d3do (version 99.9.9). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging testing-d3do across your stack and pipelines.
If you installed it — respond
Remove testing-d3do from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If testing-d3do was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks testing-d3do before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. testing-d3do on npm has been identified as a malicious package (version 99.9.9 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009109

References

npmjs.com

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks testing-d3do-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database