@mlspace/allocations@99.99.99
Malicious code in @mlspace/allocations (npm)
T1071 · Application Layer ProtocolT1041 · Exfiltration Over C2 Channel
Analysis
Dependency-confusion stub in the @mlspace namespace at version 99.99.99, a ~7KB bundle with a postinstall lifecycle hook. The scripts/postinstall.js contains the command-and-control domain oob[.]moika[.]tech and beacons to it on install. Published from a throwaway account; later unpublished from the registry (replaced by a 0.0.1-security placeholder).
- analyzed by
- Leitwacht
- first seen
- May 28, 2026, 09:02 AM
- analyzed
- Jun 1, 2026, 06:45 PM
Related advisories
- @mlspace/experiments-monitoring@99.99.99
- @mlspace/env-jupyter-server@99.99.99
- @mlspace/dtransfer-history@99.99.99
- @mlspace/experiments@99.99.99
- @veygo/component-library@99.9.2
- @mlspace/profile@99.99.99
- botmaker-cli@0.1.19
- n8n-nodes-flowstats@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.