Which versions of testing-d3do are malicious?

The following npm versions of testing-d3do are flagged malicious: 99.9.9. Treat any of these as compromised.

How do I remediate testing-d3do if I installed it?

Remove testing-d3do from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed testing-d3do — how do I know if it already compromised me?

If testing-d3do was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is testing-d3do part of a known attack campaign?

Yes — testing-d3do is associated with the IN-MAL-2026-009109 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find testing-d3do across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for testing-d3do (version 99.9.9).

Malicious package

testing-d3donpm

Advisory published Jul 9, 2026Updated Jul 9, 2026

testing-d3do is a confirmed malicious npm package (MAL-2026-10006) that executes malicious code on install (malicious version 99.9.9). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in testing-d3do (npm)

MAL-2026-10006

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall testing-d3do

What this malware does

On npm install, this package's postinstall script collects host identifiers (os.hostname(), os.userInfo(), current working directory, and external IPv4 address) and POSTs them to a hardcoded subdomain under oast.fun (lpzlajzjfkpfeefuzxbv6n5nob7bpuh6e.oast.fun, path /receive-data). oast.fun is an Interactsh out-of-band collector commonly used for dependency-confusion reconnaissance. The package metadata is consistent with a dependency-confusion squat: name prefixed with 'testing-', version 99.9.9 (unrealistically high to win registry resolution against an internal package of the same short name), empty author/description/keywords. Installing this package causes the installer's machine identifiers and network address to be sent to a third-party collector controlled by whoever registered the OAST subdomain.

The OpenSSF Package Analysis project identified 'testing-d3do' @ 99.9.9 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

1 flagged

99.9.9

Indicators of compromise (SHA-256)

cbb133c89692a67e9aff0a4777c486d480852fb223a5ac9b7c983ae94cdceef6

6c008bcf9a72a02f11c556396a39d6de999bfad0cfa389ddac01929d19bb34d8

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for testing-d3do (version 99.9.9).
If you installed it — respond
Remove testing-d3do from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If testing-d3do was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. testing-d3do on npm has been identified as a malicious package (version 99.9.9 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009109

References

npmjs.com

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks testing-d3do-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database