LWA-2026-11517 confirmed malware
@saidddddddddd/ggsgg@1.0.0
Malicious code in @saidddddddddd/ggsgg (npm)
T1105 · Ingress Tool TransferT1071.001 · Web Protocols
Analysis
The package ships an empty index.js and a loader (index.html and index.svg) that, when opened, fetches the latest version of the package from unpkg[.]com at runtime and injects the returned HTML/scripts into the page. The executed content is therefore fetched live from the publisher's own package and can be changed at any time by publishing a new version, making the runtime behaviour fully publisher-controlled rather than fixed at install time.
- analyzed by
- Leitwacht
- first seen
- Aug 19, 2026, 11:15 PM
- analyzed
- Aug 19, 2026, 11:17 PM
Related advisories
- mc-provider@1.0.10
- @oss-core-eng/data-formatter@1.0.1
- @wizloft/harness-kernel@0.1.1-alpha.3
- @wizloft/harness-context@0.1.1-alpha.3
- anhn-cli@1.1.4
- @wizloft/harness-validation@0.1.1-alpha.3
- @wizloft/harness-plugin-repository-files@0.1.1-alpha.3
- @wizloft/harness@0.1.1-alpha.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.