LWA-2026-4796 confirmed malware
pt-logger-telemetry-eax0x1@1.0.0
Malicious code in pt-logger-telemetry-eax0x1 (npm)
T1059.007 · JavaScriptT1552.001 · Credentials In FilesT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
Disguised as a "lightweight logging utility," this package runs a postinstall hook that harvests credentials (GITHUB_TOKEN, AWS_ACCESS_KEY, DEPLOY_TOKEN) from environment variables along with system metadata (hostname, OS, platform, username, CI status). All data is exfiltrated via HTTPS POST to an OAST callback domain (tfcvc3fenlh6hdnqgw4e6ko8lzrqfj38[.]oastify[.]com) in both the JSON body and custom HTTP headers. Error handling is suppressed so the victim sees no errors.
- analyzed by
- Leitwacht
- first seen
- Jun 12, 2026, 04:23 PM
- analyzed
- Jun 12, 2026, 04:26 PM
Related advisories
- pretty-pino-logger@2.0.2
- prettlog@1.0.10
- ttspc-server-sample@9.0.0
- polymarket-onchain-plugin@2.1.3
- polymarket-ai-agent@0.1.0
- polygon-bitquery-apis@2.2.3
- pocbitbarrontest@1.0.0
- pino-sdk-v2@9.9.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.