@cloudplatform-single-spa/dataplatform-trino@99.99.99
Malicious code in @cloudplatform-single-spa/dataplatform-trino (npm)
T1195.002 · Compromise Software Supply ChainT1059 · Command and Scripting InterpreterT1546.016 · Installer PackagesT1071 · Application Layer Protocol
Analysis
Dependency-confusion stub @cloudplatform-single-spa/dataplatform-trino@99.99.99 (~7.9KB) from serial-malware account [account]. The scripts/postinstall.js hook executes on install and beacons to command-and-control host oob[.]moika[.]tech. Package was published then removed from the registry (publish-and-burn).
- analyzed by
- Leitwacht
- first seen
- May 28, 2026, 09:00 AM
- analyzed
- Jun 1, 2026, 07:55 PM
- weekly installs
- 99
Related advisories
- @cloudplatform-single-spa/enterprise@99.99.99
- @cloudplatform-single-spa/notification-gateway@99.99.99
- @cloudplatform-single-spa/security-groups@99.99.99
- @cloudplatform-single-spa/ml-inference-comfy-run@99.99.99
- dt-fe-t2d-marketplace@71.0.2
- @catamania/front-components@1.0.2
- masterkrweb@9.9.9
- @convera/ui-shared@0.0.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.