LWA-2026-11413 confirmed malware
prism-registry@1.0.1
Malicious code in prism-registry (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1005 · Data from Local SystemT1041 · Exfiltration Over C2 Channel
Analysis
The package's preinstall hook runs index.js, which collects the hostname, username, home directory, DNS servers, and the full contents of /etc/passwd and /etc/hosts from the machine where it is installed, and POSTs them as JSON over HTTPS to the Burp Collaborator endpoint zjmjb1b5mnwtdcmzrsq6uj4bj2ptdj18[.]oastify[.]com:443. This exfiltrates system metadata and sensitive system files at install time.
- analyzed by
- Leitwacht
- first seen
- Aug 18, 2026, 10:42 AM
- analyzed
- Aug 18, 2026, 10:42 AM
Related advisories
- @evial/runtime-health@1.0.0
- @evial/init-helper-djkwt@1.0.0
- sysdo@1.0.0
- require-i18next@20.0.0
- @openrepl/shared@0.0.4
- hunterone-build-probe-9210@1.0.0
- alelo-common@99.0.0
- debug-proxy-chrome-devtools@1.0.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.