self-v8

Details

Malicious package. `self-v8` is an npm package that harvests sensitive data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.

Compromised versions (8)

• 1.0.0
• 2.1.8
• 2.1.9
• 8.1.9
• 8.3.9
• 8.5.9
• 8.7.9
• 8.9.9

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.