@hzero-front-ui/core@99.99.99
Malicious code in @hzero-front-ui/core (npm)
T1195.002 · Compromise Software Supply ChainT1059 · Command and Scripting InterpreterT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
@hzero-front-ui/core@99.99.99 is a version-squat stub (99.99.99 on a scoped name, ~1KB bundle) whose preinstall and install hooks both collect the installer's username, hostname, working directory and package name, base64-encode them, and exfiltrate them to the callback domain m0chan[.]co[.]uk via two channels: an HTTP GET to hxxps://<pkgsub>.callback[.]m0chan[.]co[.]uk/<base64> and a DNS lookup of <base64>.<pkgsub>.callback[.]m0chan[.]co[.]uk. The host-metadata beacon runs automatically on every install.
- analyzed by
- Leitwacht
- first seen
- Aug 13, 2026, 08:28 PM
- analyzed
- Aug 13, 2026, 08:29 PM
Related advisories
- @hzero-front-ui/c7n-ui@99.99.99
- @hzero-front-ui/themes@99.99.99
- @hzero-front-ui/cfg@99.99.99
- datetime-fmt-xutil@1.0.0
- check-audit@99.9.1
- mutex-forge@2.0.1
- kit-map-vim@1.0.0
- dakumangalsingh@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.