sam-package@1.0.1
Malicious code in sam-package (npm)
T1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The postinstall script silently fires an HTTPS GET to webhooksite[.]net/206fe563-3cfb-42fc-b589-b8b748b4c640 on every installation, acting as a beacon that transmits the installer's IP address, user-agent, and request metadata to a remote collector. This behaviour is unrelated to the advertised greeting-function module and is not disclosed in the package documentation.
- analyzed by
- Leitwacht
- first seen
- Jun 15, 2026, 03:23 PM
- analyzed
- Jun 15, 2026, 03:25 PM
- weekly installs
- 1,379
Related advisories
- @resolvx/core@2.4.2
- flow-lending-sdk@9.9.9
- bodega-sdk@9.9.9
- surf-lending@9.9.9
- flowdefi@9.9.9
- flowcardano@9.9.9
- flow-lending@9.9.9
- unico-check@9.9.9
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.