LWA-2026-11085 confirmed malware
tfjs-custom-module@1.0.0
Malicious code in tfjs-custom-module (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web Protocols
Analysis
The package's postinstall hook (postinstall.js) collects host metadata — hostname, platform, architecture, Node.js version, and the npm lifecycle event — and POSTs it as JSON over HTTPS to the remote host 8xq4kw5d[.]instances[.]poc[.]jchunt[.]top at path /tfjs-custom-module. The beacon fires automatically on install with no opt-in.
- analyzed by
- Leitwacht
- first seen
- Aug 12, 2026, 04:59 PM
- analyzed
- Aug 12, 2026, 05:00 PM
Related advisories
- ngsw-config@1.0.0
- gaarf-node-bq@1.0.0
- karma-proxy@1.0.0
- github-policy-bot@1.0.0
- fmt-util-k7x2@1.0.0
- @years17/n8n-nodes-helper-utils@1.0.1
- @assetshop/verify-cli@99.0.0
- kit-map-vim@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.