Which versions of wpt-client are malicious?

The following npm versions of wpt-client are flagged malicious: 100.0.0. Treat any of these as compromised.

How do I remediate wpt-client if I installed it?

Remove wpt-client from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed wpt-client — how do I know if it already compromised me?

If wpt-client was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is wpt-client part of a known attack campaign?

Yes — wpt-client is associated with the RLMA-2026-01653 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find wpt-client across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for wpt-client (version 100.0.0).

Malicious package

wpt-clientnpm

Advisory published Mar 18, 2026Updated Mar 23, 2026

wpt-client is a confirmed malicious npm package (MAL-2026-1878) that executes malicious code on install (malicious version 100.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in wpt-client (npm)

MAL-2026-1878

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall wpt-client

What this malware does

The package wpt-client was found to contain malicious code.

Malicious versions

1 flagged

100.0.0

Indicators of compromise (SHA-256)

ca6797001232d5a2910d8be0ed981901d842c5262722b32a0a1b98b79e9ebe1d

6928aebd6d492c4618abb9136b97cdf065cf37f91fab0e0a11a5688cd0e4f5f7

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for wpt-client (version 100.0.0).
If you installed it — respond
Remove wpt-client from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If wpt-client was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. wpt-client on npm has been identified as a malicious package (version 100.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-01653

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks wpt-client-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database