LWA-2026-11589 confirmed malware
openai-pr-reviewer@1.0.0
Malicious code in openai-pr-reviewer (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1005 · Data from Local SystemT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
The package's preinstall hook runs index.js, which collects system information from the installer's machine — hostname, username, home directory, DNS servers, and the contents of /etc/passwd and /etc/hosts — and POSTs this data as JSON to the remote host vjib8dmg59zuxwwymzboy0ymhdn4bvzk[.]oastify[.]com:443 (a Burp Collaborator endpoint). The data exfiltration runs automatically at install time.
- analyzed by
- Leitwacht
- first seen
- Aug 24, 2026, 11:22 AM
- analyzed
- Aug 24, 2026, 11:22 AM
Related advisories
- hydration-ui-dim@1.0.0
- pump-fun-skills@20.1.1
- carbon-monorepo@20.1.1
- optimizely-starter-kit-for-fastly-compute@1.0.1
- prism-registry@1.0.1
- @evial/runtime-health@1.0.0
- @evial/init-helper-djkwt@1.0.0
- sysdo@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.