Which versions of vishal_312pkg are malicious?

The following npm versions of vishal_312pkg are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate vishal_312pkg if I installed it?

vishal_312pkg establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed vishal_312pkg — how do I know if it already compromised me?

If vishal_312pkg was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is vishal_312pkg part of a known attack campaign?

Yes — vishal_312pkg is associated with the IN-MAL-2026-019677 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find vishal_312pkg across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for vishal_312pkg (version 1.0.0).

Malicious package

vishal_312pkgnpm

Advisory published Sep 6, 2026Updated Sep 8, 2026

vishal_312pkg is a confirmed malicious npm package (MAL-2026-16006) that opens a backdoor for remote access (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in vishal_312pkg (npm)

MAL-2026-16006

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall vishal_312pkg

What this malware does

package.json declares a preinstall lifecycle script that runs on npm install and issues a wget request to https://webhook.site/ea0ca859-424d-4cc5-9210-62f7e25692a1/ carrying the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as querystring parameters. The destination is a third-party request-inspection collector hardcoded in the manifest, unrelated to any documented package purpose. This is the canonical dependency-confusion / reconnaissance beacon shape: automatic execution at install time, unconditional outbound network to an attacker-controlled endpoint, and disclosure of installer host identifiers that identify internal environments and users.

The OpenSSF Package Analysis project identified 'vishal_312pkg' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

a0c8bd63b24097ddfa37be2a0c26450b21d7963a77c5bd81bc4892b89490d51b

74d38dada8ec3921b4a3f69e7d44b5f5b54d345ff8f9581d34007a3e68679da4

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for vishal_312pkg (version 1.0.0).
If you installed it — respond
vishal_312pkg establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If vishal_312pkg was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. vishal_312pkg on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019677

References

npmjs.com

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks vishal_312pkg-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database