@cloudplatform-single-spa/airflow@99.99.99
Malicious code in @cloudplatform-single-spa/airflow (npm)
T1195.002 · Compromise Software Supply ChainT1059 · Command and Scripting InterpreterT1546.016 · Installer PackagesT1071 · Application Layer Protocol
Analysis
A dependency-confusion stub in the @cloudplatform-single-spa scope targeting internal Airflow/cloud-platform tooling, using version 99.99.99 for version-priority hijacking. The ~7.8KB package runs a postinstall hook (scripts/postinstall.js) that contacts the command-and-control domain oob[.]moika[.]tech. The package has since been unpublished.
- analyzed by
- Leitwacht
- first seen
- May 28, 2026, 08:59 AM
- analyzed
- Jun 1, 2026, 08:22 PM
- weekly installs
- 103
Related advisories
- @cloudplatform-single-spa/enterprise@99.99.99
- @cloudplatform-single-spa/notification-gateway@99.99.99
- @cloudplatform-single-spa/security-groups@99.99.99
- @cloudplatform-single-spa/ml-foundation-models@99.99.99
- @cloudplatform-single-spa/aifactory-notebooks@99.99.99
- @cloudplatform-single-spa/cloud-dns@99.99.99
- @cloudplatform-single-spa/datagrid@99.99.99
- @cloudplatform-single-spa/billing@99.99.99
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.