totally-legit-web-pack@1.2.5
Malicious code in totally-legit-web-pack (npm)
Analysis
Package totally-legit-web-pack@1.2.5 is a supply-chain attack vehicle. It declares a dependency on the known-malicious package super-useful-omega-package-123 and runs a preinstall hook on installation. The preinstall script requires('package-b') and reads baseUrl, apiKey, and supportedFormats fields to construct an installation fingerprint unique identifier. The package itself exports only a trivial hello() function and has no legitimate web-packing functionality — its sole purpose is to pull the malicious dependency into the victim's project and fingerprint the installation.
- analyzed by
- Leitwacht
- first seen
- Jun 15, 2026, 05:18 AM
- analyzed
- Jun 15, 2026, 05:19 AM
Related advisories
- tiny-string-parser@0.1.2
- hemi-supply-cron@999.0.0
- ve-hemi-rewards@999.0.0
- token-prices-cron@999.0.0
- vaults-monitor-cron@999.0.0
- hemi-earn-actions@999.0.0
- portal-backend@999.0.0
- tg-msg-effect@1.0.10
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.