MalwarePublished 20 May 2026Updated 10 Nov 2026

@solarcraft/observix (npm) · Malicious Code

Affects @solarcraft/observixSource GCVE Database

Malicious package : remove @solarcraft/observix and rotate any secrets on hosts that installed it.

Data as of 10 Nov 2026, 18:20 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4446

What to do

Remove @solarcraft/observix from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@solarcraft/observix	Affected =0.4.12	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @solarcraft/observix version 0.4.12 is a malicious package masquerading as a zero-dependency colorized logger. Upon import, it executes multiple harmful actions including installing an SSH backdoor, harvesting sensitive files from the filesystem, stealing project credentials, and sending host fingerprinting data to an attacker-controlled server. This results in full compromise of any system running the package.

Impact

Systems with this package installed or running are fully compromised. The attacker gains persistent remote shell access via the SSH backdoor and obtains a wide range of sensitive data including environment variables, project credentials, and personal documents. This compromises confidentiality and control of the affected machines. Secret keys and credentials stored on the compromised system should be considered exposed and rotated immediately from a secure environment.

Defensive guidance

Remove the @solarcraft/observix package version 0.4.12 immediately. Rotate all secrets, keys, and credentials that may have been exposed, using a different, uncompromised machine. Because the attacker may have persistent access and could have installed additional malware, consider the affected systems fully compromised and perform a thorough incident response including system reimaging if possible.

Summary

The @solarcraft/observix package (version 0.4.12) contains embedded malware that activates immediately when the package is required. It installs a persistent SSH backdoor by adding a hardcoded attacker public key to the user's authorized_keys file on Linux systems. It performs extensive data exfiltration by recursively collecting environment files, documents, and project credential files from home directories and drives on Linux, macOS, and Windows, sending them to a remote server. Additionally, it sends system information such as OS type, IP address, and username to the attacker for fingerprinting. The package's advertised functionality as a logger is a decoy, and the malicious behavior is unconditional.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Nov 2026, 18:20 UTC

Technical details

References

Community reviews