LWA-2026-11608 confirmed malware
ecobee-api@0.0.2
Malicious code in ecobee-api (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The postinstall hook of ecobee-api@0.0.2 runs a bundled beacon.js that performs an HTTP GET to hxxp://169[.]58[.]96[.]170:9001/cb?h=<hostname>&p=ecobee-api, transmitting the machine's hostname and the package name to a hardcoded remote IP on install. The package contains no other functionality.
- analyzed by
- Leitwacht
- first seen
- Aug 24, 2026, 08:36 PM
- analyzed
- Aug 24, 2026, 08:36 PM
Related advisories
- @atfm/utils@99.99.99
- @atfm/typeface@99.99.99
- @elc-online/up-analytics@99.99.99
- @atfm/atfm-material-ui@99.99.99
- auth-otp@1.0.5
- remove-bg-serverless-azure@1.0.1
- openai-pr-reviewer@1.0.0
- hydration-ui-dim@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.