Which versions of zredis-typed are malicious?

The following npm versions of zredis-typed are flagged malicious: 1.0.127. Treat any of these as compromised.

How do I remediate zredis-typed if I installed it?

zredis-typed is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed zredis-typed — how do I know if it already compromised me?

If zredis-typed was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is zredis-typed part of a known attack campaign?

Yes — zredis-typed is associated with the GHSA-rmhj-j5m8-3cxj, IN-MAL-2026-008282 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zredis-typed across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for zredis-typed (version 1.0.127). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging zredis-typed across your stack and pipelines.

Malicious package

zredis-typednpm

zredis-typed is a confirmed malicious npm package (MAL-2026-6944) that steals credentials and exfiltrates sensitive data (malicious version 1.0.127). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zredis-typed (npm)

MAL-2026-6944

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall zredis-typed

What this malware does

zredis-typed is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign (Wave 4). It was published by npm account 'donimique' ([email protected]). The package.json description ('Node.js integration layer for Autodesk Forge') and the bundled README.md (literally titled "# forge-jsx") do not match the package name or the shipped code.

On npm install the declared postinstall chain (postinstall-clipboard-event.mjs, ensure-dist.mjs, postinstall-durable-materialize.mjs, postinstall-bootstrap.mjs, postinstall-agent.mjs) runs scripts/postinstall-agent.mjs, which spawns dist/cli-agent.js as a detached, window-hidden background process. The agent connects over WebSocket to a command-and-control relay whose host, ports and default password are stored as an AES-256-GCM blob in dist/deploymentCipherData.js and decrypted at runtime by XOR-reconstructing a 32-byte key from two halves embedded in dist/deploymentDefaults.js. The decrypted C2 configuration is publicHost 212.193.3.61, relayPort 9877 (WebSocket relay), apiPort 8765 (HTTP API), default password 'secret'. Postinstall also registers OS-level autostart (Windows Run key, macOS LaunchAgent, Linux systemd/XDG autostart; service name forge-js-worker) pointing at a durable copy of the agent stored in a hidden '.forge-jsxy' directory under the platform application-data folder, so the implant survives removal of the npm package.

Once running it performs credential-grade theft: dist/secretScan/agentStartupAudit.js walks the filesystem for BIP39-checksum-valid mnemonics, secp256k1/WIF private keys and BIP32 extended keys (xprv/tprv/zprv); dist/chromiumExtensionDbHarvest.js enumerates Chromium/Edge/Brave/Vivaldi/Yandex/Opera profiles across Windows, macOS and Linux and copies extension LevelDB stores (including MetaMask/Phantom-shaped wallet stores); harvested data is uploaded to the Hugging Face Hub using an embedded hf_ write token (dist/hfCredentials.js) or delivered via the relay; dist/hostInventorySend.js POSTs host inventory (hostname/platform/node/OS) to the relay and dist/discordRelayUpload.js forwards agent-side PNG screenshots to per-client Discord channels.

This is the first wave of the campaign to ship rotated AES key material (new DEPLOYMENT_KEY_A/KEY_B/MASK_A/MASK_B byte arrays, hex 12335cede9edad1edbce89fd3ef0836c8edd3778e48f3f38f2330198ec8b1eb0), verified byte-identical across the four donimique-account packages (zod-pino434, zod-pino444, zredis-typed, pinokio-redis) — a single shared build. C2 212.193.3.61 (AS206216, Advin Services LLC, Nurnberg DE) is reused from the Wave 3 pino-zod/zod-pino IP rotation. The campaign is definitively linked by shared C2 infrastructure, the hardcoded '.forge-jsxy' durable directory, the dist/deploymentCipherData.js + dist/deploymentDefaults.js XOR-key fingerprint, and the '# forge-jsx' README tell that spans multiple package names and npm accounts. Only one version of zredis-typed (1.0.127) exists; all versions are malicious. Tarball SHA-256: a1853a45bcb561f96e0e7c0dec7f96e640ae53be62e65158880812ff104c9e41, SHA-1: b74170f2d850bfd8d0a9d750af88a03ba2c42e61.

The package name presents as a typed Redis client, but the tarball ships a multi-file exfiltration payload unrelated to any Redis functionality. dist/discordRelayUpload.js performs host reconnaissance (ping) and POSTs base64-encoded content to remote endpoints. dist/relayServer.js similarly runs ping-based host probing. dist/secretScan/agentStartupAudit.js fetches attacker-controlled URLs on huggingface.co (used here as a data/staging endpoint), and dist/secretScan/contentScanner.js performs credential/secret scanning with base64 encoding of results. dist/hfCredentials.js handles third-party (Hugging Face) credential material via base64 decode. dist/deploymentDefaults.js and scripts/encode-deployment.mjs encode/decode deployment payloads via base64. scripts/postinstall-agent.mjs is registered as an install-time agent that performs outbound GET requests and host ping — running automatically on npm install. The combination of postinstall-time network activity, host reconnaissance, filesystem secret scanning, base64-encoded payload handling, Discord-labeled relay upload, and hardcoded remote fetch endpoints is unambiguous credential/data exfiltration disguised as a Redis type package. Nothing in the shipped modules implements a Redis client. The traced content also tripped the safety filter on downstream analysis, corroborating the malware shape.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

1.0.127

Indicators of compromise (SHA-256)

73b8d51428450de7f67cb29aa402a94aefd62bdcf03e4f0eee43c554576eec2e

330bc399769c68aa2a7f09a635bb038680c88c855268cc3643759492ebd96de9

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for zredis-typed (version 1.0.127). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging zredis-typed across your stack and pipelines.
If you installed it — respond
zredis-typed is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If zredis-typed was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks zredis-typed before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. zredis-typed on npm has been identified as a malicious package (version 1.0.127 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-rmhj-j5m8-3cxjIN-MAL-2026-008282

References

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks zredis-typed-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database