MalwarePublished 9 Jun 2026Updated 8 Jul 2026

kecak256 (npm) · Malicious Code

Affects kecak256Source GCVE Database

Malicious package : remove kecak256 and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 10:10 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5342

What to do

Remove kecak256 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmkecak256	Affected 1.0.0 – 1.0.5 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'kecak256' is a typosquatting malicious package impersonating the legitimate 'keccak256' package by dropping one 'c' in the name. It includes a credential-stealing payload that executes automatically upon installation. The package uses obfuscated scripts to spawn hidden processes that collect browser and credential store data, archive it, and exfiltrate it in chunks to a command-and-control server. The package author field is also impersonated to match the legitimate maintainer. Multiple versions of this package are affected. Any system with this package installed should be considered compromised, and secrets should be rotated immediately.

Impact

Systems that have installed the 'kecak256' package are at high risk of credential theft and full compromise. The malicious payload steals browser and credential store data, including sensitive login information and application keys, archives it, and exfiltrates it to an attacker-controlled server. This can lead to unauthorized access, data breaches, and further compromise of the affected systems. Because the package runs code automatically on installation with elevated privileges, the attacker may gain persistent control over the system. Secrets and keys stored on compromised machines should be considered exposed and rotated immediately.

Defensive guidance

The recommended mitigation is to immediately remove the 'kecak256' package from all affected systems. Because the package executes a credential-stealing payload on install, any system with this package installed should be considered fully compromised. All secrets, credentials, and keys stored on these systems must be rotated from a trusted, uncompromised environment. Monitor for any suspicious activity related to credential misuse. Avoid installing packages with names similar to popular libraries to prevent typosquatting attacks.

Summary

The 'kecak256' npm package is a malicious typosquat of the legitimate 'keccak256' package. It mimics the legitimate package's author and README to deceive users. The package.json defines a postinstall script that runs obfuscated JavaScript code (init.m.js) which launches a hidden process (upchk.m.js). This second stage script checks for administrative privileges, targets browser credential stores (e.g., Chrome's Login Data), archives stolen data into a zip file, and exfiltrates it in 5MB chunks to a runtime-decoded C2 URL using axios and FormData. The package dependencies include archiver, axios, and form-data to facilitate this exfiltration. The affected versions are 1.0.0, 1.0.1, 1.0.2, and 1.0.5. The threat represents a supply chain compromise risk through typosquatting and credential theft.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 10:10 UTC

Technical details

References

Community reviews