line-through@1.0.0
Malicious code in line-through (npm)
Analysis
The package's preinstall hook (node vishu.js) runs a covert host-metadata beacon on install. It fetches the machine's public IP from api[.]ipify[.]org, then sends a GET request to hxxps://webhook[.]site/66059630-2030-4b44-b2df-d37e02be0a7d with the IP and CI environment metadata (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_RUN_ATTEMPT) appended as query parameters. It also performs a DNS lookup to ping-<hostname>.your-collab-domain[.]oastify[.]com, leaking the hostname via DNS. The package's stated purpose is a dependency test utility, which does not explain this outbound beaconing.
- analyzed by
- Leitwacht
- first seen
- Sep 2, 2026, 01:46 AM
- analyzed
- Sep 2, 2026, 01:46 AM
Related advisories
- order-package-saas@999.0.0
- bt2-api-gateway-node-js@999.0.0
- cminhouse-api-gateway-nodejs@999.0.0
- quartz-core@99.1.9
- @divineubg/divine@1.1.2
- fuels-versions@1.0.0
- com.db.autobahn.notification-center-electron@88.88.1
- test__123q1@2.1.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.