LWA-2026-11081 confirmed malware
github-policy-bot@1.0.0
Malicious code in github-policy-bot (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web Protocols
Analysis
The package's postinstall hook (postinstall.js) runs automatically on install and sends a host-metadata beacon to the remote host vlfl47tl[.]instances[.]poc[.]jchunt[.]top at path /github-policy-bot. The beacon POSTs the machine's hostname, platform, architecture, Node.js version, and the npm lifecycle event as JSON. The package name impersonates the legitimate googlemaps js-github-policy-bot project.
- analyzed by
- Leitwacht
- first seen
- Aug 12, 2026, 04:58 PM
- analyzed
- Aug 12, 2026, 04:58 PM
Related advisories
- fmt-util-k7x2@1.0.0
- @years17/n8n-nodes-helper-utils@1.0.1
- @assetshop/verify-cli@99.0.0
- kit-map-vim@1.0.0
- velora-kit@12.0.2
- dakumangalsingh@1.0.0
- @dgn-src-click-to-pay-org/srcdcfreleasecert@999.0.1
- developer-dashboard@1.0.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.