LWA-2026-12895 MAL-2026-4933 ↗ confirmed malware

@cloudplatform-single-spa/ml-ai-agents-agent@99.99.99

Malicious code in @cloudplatform-single-spa/ml-ai-agents-agent (npm)

T1195.002 · Compromise Software Supply ChainT1059 · Command and Scripting InterpreterT1546.016 · Installer PackagesT1071 · Application Layer Protocol

Analysis

Dependency-confusion stub @cloudplatform-single-spa/ml-ai-agents-agent@99.99.99 (~7.9KB) from serial-malware account [account]. Its scripts/postinstall.js contacts command-and-control host oob[.]moika[.]tech on install. Package has since been removed from the registry.

analyzed by
Leitwacht
first seen
May 28, 2026, 09:00 AM
analyzed
Jun 1, 2026, 08:47 PM
weekly installs
106
npm package ↗ OSV record MAL-2026-4933 ↗ Request takedown / dispute →

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.