test1sdsd2@99.99.99
Malicious code in test1sdsd2 (npm)
T1059.007 · JavaScriptT1071.001 · Web Protocols
Analysis
The package ships preinstall and postinstall hooks that both execute index.js, which sends an HTTP GET request to hxxp://128[.]199[.]122[.]145/?test1sdsd2 at install time, beaconing the package name to a hardcoded remote IP. The package is a 556-byte stub with no other functionality.
- analyzed by
- Leitwacht
- first seen
- Sep 18, 2026, 08:40 PM
- analyzed
- Sep 18, 2026, 08:41 PM
Related advisories
- test1gg234@99.99.99
- test1df23@99.99.99
- test1hh235@99.99.99
- test12vv36@99.99.99
- internallib_v949@1.0.3
- tailwind-form-styles@0.5.1
- x509-escaping@1.0.1
- openmct-heatmap@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.