Which versions of type-atob are malicious?

The following npm versions of type-atob are flagged malicious: 3.3.7. Treat any of these as compromised.

How do I remediate type-atob if I installed it?

Remove type-atob from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed type-atob — how do I know if it already compromised me?

If type-atob was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is type-atob part of a known attack campaign?

Yes — type-atob is associated with the IN-MAL-2026-009697 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find type-atob across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for type-atob (version 3.3.7). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging type-atob across your stack and pipelines.

Malicious package

type-atobnpm

Malicious code in type-atob (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10174

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall type-atob

What this malware does

The package advertises itself as a pino-style logger (exports module.exports.pino = middleware, keywords fast/logger/stream/json, pino-like file layout under lib/) but its name and behavior are unrelated to logging. When the module is loaded via require(), its middleware factory spawns a detached node child process (spawn('node', [script,...], { detached: true, stdio: 'ignore' }), followed by child.unref()) running lib/caller.js. lib/caller.js fetches a JSON document from https://json.extendsclass.com/bin/49b93b00acf1 with https://jsonkeeper.com/b/XRGF3 as fallback, extracts the cookie field from the response, and executes it via new Function.constructor('require', s) with require passed in, granting the fetched code full Node module access. Additional endpoints are hidden as base64-encoded strings in a fake process stub inside lib/caller.js and lib/const.js (DEV_API_KEY decoding to https://jsonkeeper.com/b/XRGF3 and https://jsonkeeper.com/b/4NAKK). The remote content is attacker-mutable paste-style hosting, and the detached/unref/stdio-ignored spawn shape conceals the loader from the parent process.

Malicious versions

1 flagged

3.3.7

Indicators of compromise (SHA-256)

a69dbe06ae711c652bace745ae01fe11b2472c8d3b9891b02828cab9bfa8f653

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for type-atob (version 3.3.7). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging type-atob across your stack and pipelines.
If you installed it — respond
Remove type-atob from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If type-atob was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks type-atob before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. type-atob on npm has been identified as a malicious package (version 3.3.7 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009697

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks type-atob-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring