@cloudplatform-single-spa/svp-bare-metal-servers@99.99.99
Malicious code in @cloudplatform-single-spa/svp-bare-metal-servers (npm)
T1195.002 · Compromise Software Supply ChainT1059 · Command and Scripting InterpreterT1546.016 · Installer PackagesT1071 · Application Layer Protocol
Analysis
Known C2 domain oob[.]moika[.]tech in scripts/postinstall.js (confirmed by analyst-observed C2 table). Package is a dependency-confusion stub: name mimics @cloudplatform-single-spa internal component, version 99.99.99 (placeholder), 8KB bundle with no real code, a lifecycle hook that phones home. Publisher [account] is throwaway. Package already yanked (404). This is a postinstall C2 beacon in a dependency-confusion attack — recommend immediate human writeup and C2 blocklist enrichment.
- analyzed by
- Leitwacht
- first seen
- May 28, 2026, 09:02 AM
- analyzed
- Jun 1, 2026, 08:54 PM
- weekly installs
- 107
Related advisories
- @cloudplatform-single-spa/enterprise@99.99.99
- @cloudplatform-single-spa/notification-gateway@99.99.99
- @cloudplatform-single-spa/security-groups@99.99.99
- @cloudplatform-single-spa/installations@99.99.99
- @cloudplatform-single-spa/ml-ai-agents-agent@99.99.99
- @cloudplatform-single-spa/iam@99.99.99
- @cloudplatform-single-spa/administration@99.99.99
- @cloudplatform-single-spa/vpn@99.99.99
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.