grafeno-core@1.0.0
Malicious code in grafeno-core (npm)
T1059.007 · JavaScriptT1059.004 · Unix ShellT1105 · Ingress Tool TransferT1053.003 · CronT1546.004 · Unix Shell Configuration ModificationT1071.001 · Web Protocols
Analysis
The preinstall hook of grafeno-core@1.0.0 downloads and executes a remote shell script from hxxp://216[.]126[.]236[.]46/x[.]sh via curl|sh at install time. It then establishes persistence by appending a curl|sh command to ~/.bashrc and ~/.profile, and installs a cron job that re-fetches and executes the script every 30 minutes. The package contains no other functionality.
- analyzed by
- Leitwacht
- first seen
- Aug 28, 2026, 10:48 PM
- analyzed
- Aug 28, 2026, 10:48 PM
Related advisories
- spc-grafeno@1.0.0
- wormgpt-cli@1.0.1
- streak-metrics-math@1.0.1
- streak-metrics-core@1.0.0
- @epsteinlovekids483/crossmint-wallets-sdk-pentest@1.0.0-pentest
- base58-cli@1.0.0
- @wacrot/infra-data-kit@2.1.4
- noon-contracts@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.