Which versions of weight2loss are malicious?

The following npm versions of weight2loss are flagged malicious: 1.0.5. Treat any of these as compromised.

How do I remediate weight2loss if I installed it?

weight2loss is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed weight2loss — how do I know if it already compromised me?

If weight2loss was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is weight2loss part of a known attack campaign?

Yes — weight2loss is associated with the IN-MAL-2026-016845 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find weight2loss across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for weight2loss (version 1.0.5).

Malicious package

weight2lossnpm

Advisory published Aug 6, 2026Updated Aug 7, 2026

weight2loss is a confirmed malicious npm package (MAL-2026-13485) that steals credentials and exfiltrates sensitive data (malicious version 1.0.5). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in weight2loss (npm)

MAL-2026-13485

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall weight2loss

What this malware does

The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: (1) reads installer-side secrets from ~/.npmrc, ~/.ssh/, ~/.gitconfig, ~/.aws/, and a curated list of credential-shaped environment variables (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, etc.); (2) exfiltrates the collected data, and a base64-encoded copy of process.env, to the hardcoded endpoint https://news.reimbursor.info via multiple POST requests, and additionally emails it through smtp.gmail.com using hardcoded attacker credentials ([email protected]); (3) pipes http://attacker.com/miner.sh and http://attacker.com/backdoor.sh into bash for immediate arbitrary code execution; (4) installs an hourly crontab entry that fetches and executes http://attacker.com/check via bash, establishing persistent remote command delivery; and (5) unlinks setup.js after execution to reduce forensic traces. The postinstall key is currently declared as a top-level package.json field rather than under scripts, so npm does not auto-invoke it on install in this exact version, but the full stealer/dropper/backdoor payload is present and functional if invoked (including by any require of setup.js or a corrected manifest). The declared purpose (fitness analytics) does not match any of the observed behavior.

Malicious versions

1 flagged

1.0.5

Indicators of compromise (SHA-256)

e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for weight2loss (version 1.0.5).
If you installed it — respond
weight2loss is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If weight2loss was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. weight2loss on npm has been identified as a malicious package (version 1.0.5 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-016845

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks weight2loss-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database