test-nonmal-pkg-5@1.0.1
Malicious code in test-nonmal-pkg-5 (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1552.001 · Credentials In FilesT1041 · Exfiltration Over C2 Channel
Analysis
Package test-nonmal-pkg-5@1.0.1 contains obfuscated JavaScript that harvests all environment variables (including NPM_TOKEN, GITHUB_TOKEN, and other secrets) and POSTs them as JSON to a configurable endpoint (default hxxp://127[.]0[.]0[.]1:4000/collect). The code runs when the package is required. The obfuscation hides a credential-exfiltration payload, and the source includes a prompt-injection comment attempting to evade automated analysis.
- analyzed by
- Leitwacht
- first seen
- Jun 14, 2026, 09:32 PM
- analyzed
- Jun 14, 2026, 09:33 PM
Related advisories
- tailwindcss-framer-motion@1.1.3
- svg2text@3.0.0
- super-test-json@1.2.0
- stacknova@1.0.0
- sqrt-bn-enhanced@2.0.9
- spectral-corsair@999.999.1000
- sort-btree@2.1.4
- solanarpclampweb3@1.0.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.