sorrawit-dev-helper@1.0.0
Malicious code in sorrawit-dev-helper (npm)
T1059.007 · JavaScriptT1102 · Web ServiceT1041 · Exfiltration Over C2 Channel
Analysis
The package ships no code; its postinstall hook runs a node one-liner that reads /tmp/flag.txt and exfiltrates the file contents to the remote endpoint hxxps://ca37-49-237-83-218[.]ngrok-free[.]app/?flag=[.][.]. via an HTTP GET. Installing the package triggers the file read and the outbound exfiltration to the ngrok tunnel host.
- analyzed by
- Leitwacht
- first seen
- Sep 18, 2026, 04:42 AM
- analyzed
- Sep 18, 2026, 04:43 AM
Related advisories
- tailwindcss-form-utils@0.5.1
- @vitemirrorte/element-plus-vite-cli@2.9.1
- n8n-nodes-sysdiag2@2.0.0
- tailwind-form-kit@0.6.2
- tailwindcss-contact-forms@0.5.8
- @staticj/cropperjs@1.6.0
- tailwind-scrollbar-styles@4.0.3
- tailwindcss-fluid-styles@2.0.7
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.