@mlspace/model-monitoring@99.99.99
Malicious code in @mlspace/model-monitoring (npm)
T1071 · Application Layer ProtocolT1041 · Exfiltration Over C2 Channel
Analysis
A dependency-confusion stub impersonating the @mlspace scope (~7.5KB, version 99.99.99, no readme or history). Its postinstall script (scripts/postinstall.js) reaches out to the command-and-control domain oob[.]moika[.]tech on install. The package was later unpublished.
- analyzed by
- Leitwacht
- first seen
- May 28, 2026, 09:02 AM
- analyzed
- Jun 1, 2026, 06:54 PM
Related advisories
- @mlspace/experiments-monitoring@99.99.99
- @mlspace/env-jupyter-server@99.99.99
- @mlspace/dtransfer-history@99.99.99
- @mlspace/docker-registry@99.99.99
- @mlspace/inference-build@99.99.99
- @mlspace/shared-storage@99.99.99
- @mlspace/file-manager@99.99.99
- @mlspace/allocations@99.99.99
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.