VYPR
← All malware advisories

npm · Malicious package advisory

Malware

period-newline

MAL-2026-3181

Malicious code in period-newline (npm)

Details

Malicious npm package published by threat actor "ryanmccollum1" impersonating a benign text-formatting utility. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git history, exfiltrating over a raw TCP socket to an AWS-hosted C2. Published by threat actor "ryanmccollum1" as part of the same campaign as redeem-onchain-sdk.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8767021a9be7ca72d7ce96c66b0908ab5750ac7e7e9e6e1d4dab952d5f3028f9)
The package period-newline was found to contain malicious code.

Compromised versions (1)

  • 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.