What does the uuu8lgd malware do?

The package uuu8lgd was found to contain malicious code. The OpenSSF Package Analysis project identified 'uuu8lgd' @ 1.0.10 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

Which versions of uuu8lgd are malicious?

The following npm versions of uuu8lgd are flagged malicious: 1.0.1, 1.0.2, 1.0.7, 1.0.10, 1.0.11, 1.0.14, 1.0.17, 1.0.19, 1.0.22, 1.0.24. Treat any of these as compromised.

How do I remediate uuu8lgd if I installed it?

Remove uuu8lgd from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed uuu8lgd — how do I know if it already compromised me?

If uuu8lgd was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

How do I find uuu8lgd across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for uuu8lgd (10 malicious versions).

Malicious package

uuu8lgdnpm

Advisory published Jan 22, 2026Updated Jan 23, 2026

uuu8lgd is a confirmed malicious npm package (MAL-2026-466) that executes malicious code on install (malicious versions 1.0.1, 1.0.2, 1.0.7…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in uuu8lgd (npm)

MAL-2026-466

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall uuu8lgd

What this malware does

The package uuu8lgd was found to contain malicious code.

The OpenSSF Package Analysis project identified 'uuu8lgd' @ 1.0.10 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Malicious versions

10 flagged

1.0.11.0.21.0.71.0.101.0.111.0.141.0.171.0.191.0.221.0.24

Indicators of compromise (SHA-256)

aa4d9125702fd82fb441bb84144f6be9c8a907df6dafbf8763298164d2eac64e

f21287ddfeceba75b1d61a1ee1fee1952269d2b5a919db08f079e0fd8ccbcdad

07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2

3fdea801a42a9d0815992cfbd09c19069aea4a5e3fa82310a4f1715e2128c620

d7d2feee8eec94e337eaff29127d096cdbbdd368ad9127e8110c2009fbb5499f

d3cd4504da698fcf215d47ceadcf35ebd73593e4c0616e481fef430981dffad5

34100015b0ba37489e9dd70d0c7a246b183ecaeb11ee9aeea197922915433201

43b84c3ddb9c30dfe6860ac38e3771ba6a9fd0478e3d16dcb39c340a524298b5

70bfbe5be9f3bb2fdb58474beb0aee2cacde9bd59ea518de5ed291eb7270b4f2

2469f8a646b986709263e1d49dc00ead1623d19bac17e3288eed4f8480ee121a

1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for uuu8lgd (10 malicious versions).
If you installed it — respond
Remove uuu8lgd from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If uuu8lgd was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. uuu8lgd on npm has been identified as a malicious package (versions 1.0.1, 1.0.2, 1.0.7, 1.0.10, 1.0.11, 1.0.14, 1.0.17, 1.0.19, and 2 more flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks uuu8lgd-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database