LWA-2026-11097 confirmed malware
chrome-enterprise-premium-mcp@1.0.0
Malicious code in chrome-enterprise-premium-mcp (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 ChannelT1497 · Virtualization/Sandbox Evasion
Analysis
The package's postinstall hook (postinstall.js) runs on install and sends a JSON beacon of host metadata — hostname, platform, architecture, Node version, and the npm lifecycle event — via an HTTPS POST to 0vi0ck12[.]instances[.]poc[.]jchunt[.]top at path /chrome-enterprise-premium-mcp. The beacon fires automatically on every install with no opt-in. The package also performs a DNS TXT lookup for a local attached marker, probing for analysis environments before beaconing.
- analyzed by
- Leitwacht
- first seen
- Aug 12, 2026, 04:59 PM
- analyzed
- Aug 12, 2026, 05:03 PM
Related advisories
- dolyame-boxy-desktop-bnpl-popup@35.8.4
- bnpl-blocks-atom-bnpl-reviews-counter@35.3.6
- bnpl-blocks-desktop-bnpl-text-block@35.9.4
- dolyame-ui-link@35.8.5
- bigops-api@35.8.8
- eacq-api@35.6.1
- @onereach/slack-helpers@1.0.5
- tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events@20.2.5
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.