@cloudplatform-single-spa/svp-interfaces@99.99.99
Malicious code in @cloudplatform-single-spa/svp-interfaces (npm)
T1071 · Application Layer ProtocolT1041 · Exfiltration Over C2 Channel
Analysis
Dependency-confusion stub mimicking the @cloudplatform-single-spa cloud-infrastructure namespace at version 99.99.99 to exploit npm semver resolution, a tiny ~7.9KB bundle with a postinstall lifecycle hook. The scripts/postinstall.js contains the command-and-control domain oob[.]moika[.]tech. Published from a throwaway account in a publish-and-burn pattern; later removed from the registry.
- analyzed by
- Leitwacht
- first seen
- May 28, 2026, 09:02 AM
- analyzed
- Jun 1, 2026, 07:41 PM
Related advisories
- @cloudplatform-single-spa/enterprise@99.99.99
- @cloudplatform-single-spa/notification-gateway@99.99.99
- @cloudplatform-single-spa/security-groups@99.99.99
- @cloudplatform-single-spa/marketplace-main@99.99.99
- @cloudplatform-single-spa/floating-ips@99.99.99
- @cloudplatform-single-spa/cnapp-ui@99.99.99
- @cloudplatform-single-spa/ml-rag@99.99.99
- @cloudplatform-single-spa/search@99.99.99
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.