LWA-2026-11679 confirmed malware
cacao1@9.9.9
Malicious code in cacao1 (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web Protocols
Analysis
The package runs a script on install (both preinstall and postinstall hooks) that reads the machine's hostname and sends it to a remote webhook collector at hxxps://eo8f3m3ho26a0nm[.]m[.]pipedream[.]net/cacao1?h=<hostname>. The package has no other functionality and no declared purpose; it is a version-squat stub (version 9.9.9, self-dependency) that beacons host metadata to a third-party endpoint during installation.
- analyzed by
- Leitwacht
- first seen
- Aug 28, 2026, 12:00 PM
- analyzed
- Aug 28, 2026, 12:01 PM
Related advisories
- hydration-ui-dlx@1.0.0
- eth-pino@2.0.3
- tailwindcss-form-styles@0.5.15
- tailwindcss-3d-animate@1.2.2
- dsh-tauri-panel-extension@0.4.0
- ckeditor5-ckbox@5.0.0
- octopus-action@1.0.1
- mt-ts-serverless-starter@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.