grafeno-utils@1.0.0
Malicious code in grafeno-utils (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1053 · Scheduled Task/JobT1071.001 · Web Protocols
Analysis
The preinstall hook downloads and executes a remote shell script from 216[.]126[.]236[.]46/x.sh via curl|sh, then installs a cron job that re-downloads and re-executes the same script every 30 minutes for persistence. The package is a 486-byte stub whose only purpose is this remote code execution at install time.
- analyzed by
- Leitwacht
- first seen
- Aug 28, 2026, 10:48 PM
- analyzed
- Aug 28, 2026, 10:48 PM
Related advisories
- hydration-ui-dlx@1.0.0
- hydration-ui-dim@1.0.0
- hydration-dim-ui@1.0.0
- kit-vim-map@1.0.0
- kit-map-streak@1.0.0
- @rblxts/services@1.6.0
- streak-map-kit@1.0.0
- streak-kit-map@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.