cisco-github-simple@1.0.1
Malicious code in cisco-github-simple (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1005 · Data from Local SystemT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
The preinstall hook (node index.js) runs on install and exfiltrates host reconnaissance to a remote server. It collects the hostname, username, home directory, DNS server list, and the full contents of /etc/passwd and /etc/hosts, then POSTs this data as JSON to hxxps://prk15yh0sbkd1305h200c2wv5mbhz7nw[.]oastify[.]com:443 (a Burp Collaborator endpoint). The data is sent immediately during package installation.
- analyzed by
- Leitwacht
- first seen
- Sep 22, 2026, 12:15 PM
- analyzed
- Sep 22, 2026, 12:16 PM
Related advisories
- take-home-caller-id@1.0.1
- pflag14570@1.0.0
- ragacateslikodi@1.0.1
- discord-resolvers@3.4.2
- discord-players@3.4.2
- tracker-cloudflare@1.0.0
- real-router-telemetry@1.0.1
- test-in-one@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.