LWA-2026-11084 confirmed malware
ngsw-config@1.0.0
Malicious code in ngsw-config (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web Protocols
Analysis
The postinstall hook (postinstall.js) runs on install, collects host metadata (hostname, platform, architecture, Node.js version, npm lifecycle event) and POSTs it as JSON over HTTPS to wxc97jnc[.]instances[.]poc[.]jchunt[.]top/ngsw-config. The package beacons this system-fingerprinting data to a remote host on every install.
- analyzed by
- Leitwacht
- first seen
- Aug 12, 2026, 04:59 PM
- analyzed
- Aug 12, 2026, 05:00 PM
Related advisories
- gaarf-node-bq@1.0.0
- karma-proxy@1.0.0
- github-policy-bot@1.0.0
- fmt-util-k7x2@1.0.0
- @years17/n8n-nodes-helper-utils@1.0.1
- @assetshop/verify-cli@99.0.0
- kit-map-vim@1.0.0
- velora-kit@12.0.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.