Which versions of type-context are malicious?

The following npm versions of type-context are flagged malicious: 3.2.7, 3.2.8, 3.2.9, 3.2.11. Treat any of these as compromised.

How do I remediate type-context if I installed it?

Remove type-context from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed type-context — how do I know if it already compromised me?

If type-context was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is type-context part of a known attack campaign?

Yes — type-context is associated with the IN-MAL-2026-010206, IN-MAL-2026-010203, IN-MAL-2026-010264, IN-MAL-2026-010280 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find type-context across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for type-context (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging type-context across your stack and pipelines.

Malicious package

type-contextnpm

Malicious code in type-context (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10440

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall type-context

What this malware does

The package presents itself as a logger (module.exports.pino, keywords fast/logger/stream/json, pino-like sibling files proto.js/multistream.js/transport.js/redaction.js) despite being named type-context. When a consumer imports the package and invokes its middleware factory, lib/caller.js is executed as a detached Node child process. That script fetches JSON from a hardcoded remote endpoint (https://jsonhosting.com/api/json/fb84ebf4/raw), extracts a 'cookie' field from the response, and passes the value to new Function.constructor('require', s)(require), executing attacker-controlled JavaScript with the real Node require injected — full module-loader privileges on the host. Fallback destinations are base64-encoded in a shadowed local process.env object labeled DEV_API_KEY, decoding to jsonkeeper.com paste URLs (https://jsonkeeper.com/b/XRGF3, https://jsonkeeper.com/b/4NAKK); this obfuscation of network destinations paired with the dynamic-code sink shows intent to evade casual review. The remote body is mutable and hosted on anonymous paste-style infrastructure, so any code the attacker chooses is executed on the installer/host.

Malicious versions

4 flagged

3.2.73.2.83.2.93.2.11

Indicators of compromise (SHA-256)

4ae7ddd2b49c21ea43d1b73e1365fbfe2fe1727cf1f27972db46961c17a47621

6e4db69b627def6f11a74d5948b91006a46a3c73d90081be6f19716133cfaafb

c4f89dddd247cd465adc522b86a44066429dae0f2d7ac8b11871d92ba15d2850

5c6706d0ad662da8d23eaf47c64780a777f3ec215d8864caf1e0962289463efb

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for type-context (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging type-context across your stack and pipelines.
If you installed it — respond
Remove type-context from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If type-context was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks type-context before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. type-context on npm has been identified as a malicious package (versions 3.2.7, 3.2.8, 3.2.9, 3.2.11 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010206IN-MAL-2026-010203IN-MAL-2026-010264IN-MAL-2026-010280

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks type-context-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring