@mlspace/profile@99.99.99
Malicious code in @mlspace/profile (npm)
T1071 · Application Layer ProtocolT1041 · Exfiltration Over C2 Channel
Analysis
Dependency-confusion malware: version 99.99.99 of @mlspace/profile overrides a private @mlspace scope. scripts/postinstall.js is a second-stage downloader that beacons host reconnaissance to the C2 endpoint oob[.]moika[.]tech/report with a hardcoded X-Secret header, then fetches and executes oob[.]moika[.]tech/payload in a separate node process. Author variables are named DEP_CONFUSION_URL/PAYLOAD/SECRET, and a Russian-language comment marks a 3-second startup delay used for sandbox evasion.
- analyzed by
- Leitwacht
- first seen
- May 28, 2026, 09:02 AM
- analyzed
- May 28, 2026, 01:24 PM
Related advisories
- @mlspace/experiments-monitoring@99.99.99
- @mlspace/env-jupyter-server@99.99.99
- @mlspace/dtransfer-history@99.99.99
- botmaker-cli@0.1.19
- n8n-nodes-flowstats@1.0.0
- chai-logger@3.0.2
- lufxchwmxwyps@1.0.0
- farplotzy@0.1.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.