flow-lending-sdk@9.9.9
Malicious code in flow-lending-sdk (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1552.001 · Credentials In FilesT1552.004 · Private KeysT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
Preinstall hook (node index.js || true) executes immediately on install. index.js collects the hostname, username, current working directory, and all environment variables whose names contain key/seed/secret/token/private/mnemonic/password/blockfrost/redis/telegram/batcher (targeting crypto wallet seeds, API tokens, cloud credentials, and other secrets) and exfiltrates them via HTTPS POST to 2[.]25[.]140[.]71:8443/surflending/npm-confusion.
- analyzed by
- Leitwacht
- first seen
- Jun 15, 2026, 02:57 PM
- analyzed
- Jun 15, 2026, 02:59 PM
Related advisories
- totally-safe-util@1.0.1
- tiny-string-parser@0.1.2
- third-sender@1.0.0
- signature-transaction@1.1.0
- sickle-wrapper@0.2.0
- rtms-manager@1.2.0
- rtms-manager-dev@1.3.0
- houzidawang806@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.