LWA-2026-11094 confirmed malware
chromecast-webdriver-cli@1.0.0
Malicious code in chromecast-webdriver-cli (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web Protocols
Analysis
The package's postinstall hook (node postinstall.js) collects host metadata — hostname, platform, architecture, Node.js version, and the npm lifecycle event — and POSTs it as JSON over HTTPS to h77svwt7[.]instances[.]poc[.]jchunt[.]top/chromecast-webdriver-cli. The beacon fires automatically on install. The package ships a no-op bin and no functional webdriver functionality; its only behaviour is this outbound metadata beacon to a remote host.
- analyzed by
- Leitwacht
- first seen
- Aug 12, 2026, 04:59 PM
- analyzed
- Aug 12, 2026, 05:02 PM
Related advisories
- chromeos-webdriver-cli@1.0.0
- gaarf-bq@1.0.0
- gaarf-node@1.0.0
- xbox-one-webdriver-cli@1.0.0
- tizen-webdriver-cli@1.0.0
- bazelisk@1.0.0
- localize-translate@1.0.0
- tfjs-inference@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.