LWA-2026-11221 confirmed malware
notafollower122@1.0.0
Malicious code in notafollower122 (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 Channel
Analysis
The postinstall hook reads the AWS ECS container metadata endpoint (ECS_CONTAINER_METADATA_URI_V4/task) to collect the cluster name, AWS account ID, task ARN, and container image names, then POSTs the entire report to the external host hxxps://mourner-slot-explicit[.]ngrok-free[.]dev. This exfiltrates cloud-infrastructure metadata from any environment where the package is installed.
- analyzed by
- Leitwacht
- first seen
- Aug 13, 2026, 10:31 PM
- analyzed
- Aug 13, 2026, 10:32 PM
Related advisories
- notafollower1@1.0.0
- @hzero-front-ui/c7n-ui@99.99.99
- @hzero-front-ui/themes@99.99.99
- @hzero-front-ui/cfg@99.99.99
- @hzero-front-ui/core@99.99.99
- notafollower@1.0.0
- cilm-ui-commons@1.1.0
- async-lock-queue@3.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.