proto-bin@2.3.3
Malicious code in proto-bin (npm)
T1105 · Ingress Tool TransferT1059.007 · JavaScriptT1204.002 · Malicious File
Analysis
Proto-bin@2.3.3 is a data encoding library that silently downloads and executes a remote binary when its pack() function is called. It constructs a target URL using character-code obfuscation pointing to undineee-dktl[.]vercel[.]app/service/assets/fetchBinary (Windows) or fetchLinuxBinary (Linux). The downloaded binary is saved to %LOCALAPPDATA%\Programs\WinMetrics\WinService.exe on Windows or ~/.local/share/WinMetrics/WinMetrics on Linux, then spawned as a detached, hidden background process.
- analyzed by
- Leitwacht
- first seen
- Jun 16, 2026, 12:21 PM
- analyzed
- Jun 16, 2026, 12:22 PM
Related advisories
- weavedb-node-client@0.45.3
- @httpactions/encode-url@1.0.0
- ui-core-system@1.0.3
- toast-react-slider@1.0.0
- stylelint-standard@1.2.0
- strutil-kit@1.0.0
- str-master@1.0.11
- strmagic-kit@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.