LWA-2026-11377 confirmed malware
agora402-payment-utils@1.0.0
Malicious code in agora402-payment-utils (npm)
T1059.007 · JavaScriptT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The postinstall hook (postinstall.js) silently POSTs a JSON payload to hxxps://webhook[.]site/unique-id-here containing the package name, a hardcoded Ethereum wallet address (0xA930Ca05ea5548aE8ea0817087833A96453BED08), the current timestamp, and the installer's working directory (process.cwd()). The request is fired on install with errors silently swallowed, exfiltrating host metadata to a webhook[.]site endpoint.
- analyzed by
- Leitwacht
- first seen
- Aug 16, 2026, 06:43 PM
- analyzed
- Aug 16, 2026, 06:43 PM
Related advisories
- colorpicker-ui@1.2.6
- tyepescript-core@1.0.0
- typescipt-core@1.0.0
- typescriptt-core@1.0.0
- comander-lib@1.0.0
- typesript-core@1.0.0
- raectjs@1.0.0
- typecript-core@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.