spc-grafeno@1.0.0
Malicious code in spc-grafeno (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1053.003 · CronT1546.004 · Unix Shell Configuration Modification
Analysis
The preinstall hook of spc-grafeno@1.0.0 downloads and executes a remote shell script from 216[.]126[.]236[.]46/x.sh at install time, then installs persistence by appending a re-execution line to ~/.bashrc and adding a crontab entry that re-fetches and runs the script every 30 minutes. The package is a stub whose only purpose is this remote-code dropper and persistent backdoor.
- analyzed by
- Leitwacht
- first seen
- Aug 28, 2026, 10:47 PM
- analyzed
- Aug 28, 2026, 10:47 PM
Related advisories
- wormgpt-cli@1.0.1
- streak-metrics-math@1.0.1
- streak-metrics-core@1.0.0
- @epsteinlovekids483/crossmint-wallets-sdk-pentest@1.0.0-pentest
- base58-cli@1.0.0
- @wacrot/infra-data-kit@2.1.4
- noon-contracts@1.0.0
- grafeno-core@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.