grafeno-auth@1.0.0
Malicious code in grafeno-auth (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1053.003 · Cron
Analysis
The preinstall hook downloads and executes a remote shell script from 216[.]126[.]236[.]46/x.sh via curl|sh, then installs a cron job that re-downloads and re-executes the same script every 30 minutes for persistence. The package's actual code is a 55-byte stub with no real functionality; it exists solely to run the remote downloader on install.
- analyzed by
- Leitwacht
- first seen
- Aug 28, 2026, 10:49 PM
- analyzed
- Aug 28, 2026, 10:49 PM
Related advisories
- grafeno-logger@1.0.0
- grafeno-config@1.0.0
- grafeno-core@1.0.0
- grafeno-client@1.0.0
- spc-grafeno@1.0.0
- space-items@1.0.0
- runtime-health@1.0.1
- kit-map-vim@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.