grafeno-config@1.0.0
Malicious code in grafeno-config (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1053.003 · CronT1071.001 · Web Protocols
Analysis
The preinstall hook of grafeno-config@1.0.0 downloads and executes a remote shell script from 216[.]126[.]236[.]46/x.sh via `curl -s ... | sh`, then installs a crontab entry that re-runs the same download-and-execute every 30 minutes (after removing any prior crontab lines referencing 216.126). Installing the package therefore runs arbitrary remote code immediately and establishes persistent re-execution on the host.
- analyzed by
- Leitwacht
- first seen
- Aug 28, 2026, 10:49 PM
- analyzed
- Aug 28, 2026, 10:49 PM
Related advisories
- grafeno-core@1.0.0
- grafeno-client@1.0.0
- spc-grafeno@1.0.0
- space-items@1.0.0
- runtime-health@1.0.1
- kit-map-vim@1.0.0
- @fedfub/string-utils@1.0.0
- weight2loss@1.0.5
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.