test89-auth@1.0.1
Malicious code in test89-auth (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1083 · File and Directory DiscoveryT1071.004 · DNST1041 · Exfiltration Over C2 Channel
Analysis
The preinstall hook runs index.js, which fingerprints the host (hostname, platform, OS release, CPU/memory, whoami, id, pwd, uname -a), enumerates the filesystem under /, /home, /opt, /var/www and /tmp, then exfiltrates the collected data via DNS queries to the callback domain dfwstre3dgnrhwm2bvkczgucc3iv6lua[.]oastify[.]com. Data is base64-encoded, split into 50-character chunks, and sent as nslookup queries of the form s.<sessionId>.<chunkCount>.<chunk>.<domain>.
- analyzed by
- Leitwacht
- first seen
- Sep 18, 2026, 02:42 PM
- analyzed
- Sep 18, 2026, 02:43 PM
Related advisories
- colorpicker-ui@1.2.6
- twilio-hackerone-poc-afe6937c@1.0.0
- simple-date-formatter-util-14@1.0.0
- simple-date-formatter-util-13@1.0.0
- simple-date-formatter-util-2@1.0.0
- streak-metrics-math@1.0.1
- json-to-table-util@1.0.0
- api-node-sdk@2.1.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.