MAL-2026-3181

    Dashboard / Malicious Package / MAL-2026-3181

    MAL-2026-3181

    Published: 29 Apr 2026Last Modified: 30 Apr 2026

    Summary: Malicious code in period-newline (npm)

    Details: Malicious npm package published by threat actor "ryanmccollum1" impersonating a benign text-formatting utility. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git history, exfiltrating over a raw TCP socket to an AWS-hosted C2. Published by threat actor "ryanmccollum1" as part of the same campaign as redeem-onchain-sdk. Source: amazon-inspector (8767021a9be7ca72d7ce96c66b0908ab5750ac7e7e9e6e1d4dab952d5f3028f9) The package period-newline was found to contain malicious code.

    References: https://safedep.io/redeem-onchain-sdk-polymarket-npm-malware/

    Affected packages

    Package

    Name: period-newline

    Purl: pkg:npm/period-newline

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    0.1.0
    MAL-2026-3181 | CVE-DB