LWA-2026-11083 confirmed malware
gaarf-node-bq@1.0.0
Malicious code in gaarf-node-bq (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web Protocols
Analysis
The postinstall hook (node postinstall.js) collects host metadata — hostname, platform, architecture, Node version, package name, and timestamp — and POSTs it to the remote endpoint yu7pug2j[.]instances[.]poc[.]jchunt[.]top at path /gaarf-node-bq. The package name impersonates the Google Ads API Report Fetcher (gaarf) project. The beacon runs automatically on install without user consent.
- analyzed by
- Leitwacht
- first seen
- Aug 12, 2026, 04:58 PM
- analyzed
- Aug 12, 2026, 04:58 PM
Related advisories
- karma-proxy@1.0.0
- github-policy-bot@1.0.0
- fmt-util-k7x2@1.0.0
- @years17/n8n-nodes-helper-utils@1.0.1
- @assetshop/verify-cli@99.0.0
- kit-map-vim@1.0.0
- velora-kit@12.0.2
- dakumangalsingh@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.