LWA-2026-5521 confirmed malware
work-planner-client@1.0.0
Malicious code in work-planner-client (npm)
T1195.002 · Compromise Software Supply ChainT1059 · Command and Scripting InterpreterT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 Channel
Analysis
work-planner-client@1.0.0 is a namespace-claim package with no shipped code — its sole purpose is a postinstall hook. On install, the hook runs a shell command that collects the system hostname, current username, and public IP address (via ifconfig[.]me) and POSTs them to hxxps://webhook-test[.]com/6f777df5fff38df949fee543c385ce22 — an external webhook capture endpoint acting as a C2 receiver for host reconnaissance data.
- analyzed by
- Leitwacht
- first seen
- Jun 16, 2026, 05:43 AM
- analyzed
- Jun 16, 2026, 05:44 AM
Related advisories
- wordsmith-kit@1.0.0
- check-ulid@3.0.2
- vue-template-compiler-plugin@2.7.16
- vl-ui-contact-card@10.1.1
- @dilxzphrine/libsignal-node@2.5.0
- @sfhbdrffthger/boardstep@1.0.0
- vite-config-field@1.1.0
- dms-backend@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.