LWA-2026-13086 confirmed malware

regex-linter@12.0.0

Malicious code in regex-linter (npm)

T1059 · Command and Scripting InterpreterT1059.007 · JavaScriptT1082 · System Information DiscoveryT1033 · System Owner/User DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel

Analysis

The package contains no linter functionality despite its name; it consists of a single 445-byte index.js wired to a postinstall hook ("node index.js"). On install it reads the local account name via os.userInfo().username and the machine name via os.hostname(), serialises them as {"p":"regex-linter","u":<username>,"h":<hostname>} and POSTs that JSON to hxxps://nathanaccacio[.]com/collect over HTTPS, discarding any error so the install completes silently. No credentials, environment values, tokens or files are read, and no additional code is downloaded or executed. The collection endpoint nathanaccacio[.]com/collect is the sole network indicator.

analyzed by
Leitwacht
first seen
Oct 19, 2026, 03:45 PM
analyzed
Oct 19, 2026, 03:46 PM
weekly installs
235

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.