LWA-2026-11087 confirmed malware
bazelisk@1.0.0
Malicious code in bazelisk (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web Protocols
Analysis
bazelisk@1.0.0 impersonates the well-known bazelisk Bazel wrapper. Its postinstall hook (postinstall.js) runs on install and POSTs a JSON payload of host metadata — hostname, platform, architecture, Node.js version, and the npm lifecycle event — to the remote host grqx3qve[.]instances[.]poc[.]jchunt[.]top at path /bazelisk over HTTPS. The beacon fires automatically during npm install with no user action.
- analyzed by
- Leitwacht
- first seen
- Aug 12, 2026, 04:59 PM
- analyzed
- Aug 12, 2026, 05:00 PM
Related advisories
- localize-translate@1.0.0
- tfjs-inference@1.0.0
- tfjs-custom-module@1.0.0
- ngsw-config@1.0.0
- gaarf-node-bq@1.0.0
- karma-proxy@1.0.0
- github-policy-bot@1.0.0
- fmt-util-k7x2@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.