regex-linter@12.0.0
Malicious code in regex-linter (npm)
Analysis
The package contains no linter functionality despite its name; it consists of a single 445-byte index.js wired to a postinstall hook ("node index.js"). On install it reads the local account name via os.userInfo().username and the machine name via os.hostname(), serialises them as {"p":"regex-linter","u":<username>,"h":<hostname>} and POSTs that JSON to hxxps://nathanaccacio[.]com/collect over HTTPS, discarding any error so the install completes silently. No credentials, environment values, tokens or files are read, and no additional code is downloaded or executed. The collection endpoint nathanaccacio[.]com/collect is the sole network indicator.
- analyzed by
- Leitwacht
- first seen
- Oct 19, 2026, 03:45 PM
- analyzed
- Oct 19, 2026, 03:46 PM
- weekly installs
- 235
Related advisories
- @galicia-toolkit/spa-build-config@999.0.6
- @galicia-toolkit/tag-manager@999.0.6
- @galicia-toolkit/spa-build-config@999.0.5
- @galicia-toolkit/tag-manager@999.0.5
- @galicia-toolkit/tag-manager@999.0.3
- css-reading-display-polyfill@1.0.0
- css-display-reading-polyfill@1.0.0
- streak-metrics-math@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.