metavu@99.21.1-1.21.127
Malicious code in metavu (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The preinstall hook (node index.js) collects host system information — hostname, platform, architecture, home directory, username/uid/gid/shell, OS type/release, total/free memory, CPU count, whoami, id, and current working directory — and POSTs it as a JSON payload to hxxps://4f54203c-996c-4f52-b136-ef9b1fd0f64d/detox56. The package also ships a file containing scraped Instagram account data. The version number is set to an artificially high value (99.21.1-1.21.127) to appear as a newer version in automated installers.
- analyzed by
- Leitwacht
- first seen
- Jun 18, 2026, 02:01 PM
- analyzed
- Jun 18, 2026, 02:02 PM
Related advisories
- computerrock-babel-preset-react-app@15.12.11
- @onum-releases/utils@1.0.1
- @dxcl/http-common-js@99.99.99
- @dxcl/fund-js@99.99.99
- @dxcl/transaction-js@99.99.99
- @dxcl/user-js@99.99.99
- @dxcl/account-js@99.99.99
- @dxcl/customer-js@99.99.99
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.