Which versions of walmart-shared-modules are malicious?

The following npm versions of walmart-shared-modules are flagged malicious: 99.0.1. Treat any of these as compromised.

How do I remediate walmart-shared-modules if I installed it?

walmart-shared-modules is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed walmart-shared-modules — how do I know if it already compromised me?

If walmart-shared-modules was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is walmart-shared-modules part of a known attack campaign?

Yes — walmart-shared-modules is associated with the IN-MAL-2026-004687, IN-MAL-2026-004686 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find walmart-shared-modules across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for walmart-shared-modules (version 99.0.1).

Malicious package

walmart-shared-modulesnpm

Advisory published May 25, 2026Updated May 26, 2026

walmart-shared-modules is a confirmed malicious npm package (MAL-2026-4710) that steals credentials and exfiltrates sensitive data (malicious version 99.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in walmart-shared-modules (npm)

MAL-2026-4710

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall walmart-shared-modules

What this malware does

Package declares preinstall: node poc.js, which on npm install collects host identity (os.hostname, whoami/id, ipconfig/ip a output), scrapes environment variables matching credential-shaped prefixes (TOKEN, AWS, AZURE, NPM, GITHUB, GITLAB, JENKINS, CI_, WALMART, WMT), reads the parent project's package.json and CI configuration files (.gitlab-ci.yml,.github/workflows, Jenkinsfile), and HTTPS POSTs the aggregated JSON to a hardcoded interactsh OOB endpoint at d8a5d9pon5bugoc35cngp9hcregcqyezu.oast.me, plus a DNS callback with a hex-encoded hostname/username. The package is published at version 99.0.1 with a self-described 'Dependency Confusion PoC' purpose targeting Walmart's internal walmart-shared-modules namespace, intended to win npm's highest-version-wins resolution. Any installer outside Walmart's authorized testing scope still suffers full environment and CI-secret exfiltration; self-declared 'security research' framing does not neutralize the harm to unrelated installers.

Malicious versions

1 flagged

99.0.1

Indicators of compromise (SHA-256)

963185e66a528f9fb7cb25980d37e538ddda90ec99330c003b3aa31a4cd516a7

e6bfb508fa412e49b249eaf5529f175ebb14f0e7d9fe19a119e8cc9acf25505a

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for walmart-shared-modules (version 99.0.1).
If you installed it — respond
walmart-shared-modules is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If walmart-shared-modules was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. walmart-shared-modules on npm has been identified as a malicious package (version 99.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-004687IN-MAL-2026-004686

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks walmart-shared-modules-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database