LWA-2026-11089 confirmed malware

tizen-webdriver-cli@1.0.0

Malicious code in tizen-webdriver-cli (npm)

T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web Protocols

Analysis

The postinstall hook (node postinstall.js) sends a JSON beacon of host metadata — hostname, platform, architecture, Node.js version, and the npm lifecycle event — over HTTPS to 8kq1s58l[.]instances[.]poc[.]jchunt[.]top:443 at path /tizen-webdriver-cli. The package describes itself as a security-research canary but provides no repository or program reference to substantiate that claim; the install-time beacon to a remote host is the package's only real behaviour.

analyzed by
Leitwacht
first seen
Aug 12, 2026, 04:59 PM
analyzed
Aug 12, 2026, 05:01 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.