eslint-plugin-i18n-shreddit@99.9.9
Malicious code in eslint-plugin-i18n-shreddit (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 Channel
Analysis
The postinstall hook executes index.js, which collects the installer's username, current working directory, hostname, and local IPv4 address and POSTs them as JSON to hxxps://webhook[.]site/f9bff304-3053-4d54-be05-86537267514a. The package is a host-metadata exfiltration beacon disguised as an ESLint plugin.
- analyzed by
- Leitwacht
- first seen
- Sep 22, 2026, 09:24 PM
- analyzed
- Sep 22, 2026, 09:25 PM
Related advisories
- @tvg-mar/utils@9.9.10
- @tvg-mar/promos-gtm@9.9.10
- @tvg-mar/promos-context@9.9.10
- @tesla-insurance/vinless-quote@9.9.10
- cisco-github-simple@1.0.1
- take-home-caller-id@1.0.1
- cloudndmcedu@1.0.0
- @uol-afiliados/affiliated-config-lib@102.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.