@cloudplatform-single-spa/event-bus@99.99.99
Malicious code in @cloudplatform-single-spa/event-bus (npm)
T1071 · Application Layer ProtocolT1041 · Exfiltration Over C2 Channel
Analysis
Dependency-confusion stub @cloudplatform-single-spa/event-bus@99.99.99 (~7.8KB) from serial-malware account [account]. Its scripts/postinstall.js hardcodes and contacts command-and-control host oob[.]moika[.]tech on install. The inflated 99.99.99 version is set to beat semver ranges. Package has since been removed from the registry.
- analyzed by
- Leitwacht
- first seen
- May 28, 2026, 09:00 AM
- analyzed
- Jun 1, 2026, 07:04 PM
Related advisories
- @cloudplatform-single-spa/enterprise@99.99.99
- @cloudplatform-single-spa/notification-gateway@99.99.99
- @cloudplatform-single-spa/security-groups@99.99.99
- @cloudplatform-single-spa/evocs@99.99.99
- @mlspace/experiments-monitoring@99.99.99
- @mlspace/env-jupyter-server@99.99.99
- @mlspace/dtransfer-history@99.99.99
- @mlspace/inference-deploy@99.99.99
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.