Which versions of tnaxmlparserctf are malicious?

The following npm versions of tnaxmlparserctf are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate tnaxmlparserctf if I installed it?

Remove tnaxmlparserctf from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed tnaxmlparserctf — how do I know if it already compromised me?

If tnaxmlparserctf was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tnaxmlparserctf part of a known attack campaign?

Yes — tnaxmlparserctf is associated with the RLMA-2026-01622 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tnaxmlparserctf across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tnaxmlparserctf (version 1.0.0).

Malicious package

tnaxmlparserctfnpm

Advisory published Dec 11, 2025Updated Mar 19, 2026

tnaxmlparserctf is a confirmed malicious npm package (MAL-2025-192466) that executes malicious code on install (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tnaxmlparserctf (npm)

MAL-2025-192466

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall tnaxmlparserctf

What this malware does

The package tnaxmlparserctf was found to contain malicious code.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

f5028d4ab741d3e7b9c3cb92e1275a1d29d1e6cd8157590f7871d02b8b2a5d23

095c59252d8f17e88cc2f286a690f797ba8c04111a2d70ccf058dbc384b3f0c8

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for tnaxmlparserctf (version 1.0.0).
If you installed it — respond
Remove tnaxmlparserctf from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If tnaxmlparserctf was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tnaxmlparserctf on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-01622

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks tnaxmlparserctf-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database