triage-bot@1.0.1
Malicious code in triage-bot (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
triage-bot@1.0.1 runs a preinstall hook (node index.js) that collects system information from the installation machine — hostname, home directory, username, DNS server addresses — and reads the contents of /etc/passwd and /etc/hosts. All collected data is exfiltrated via HTTPS POST to t3x60c96rz2gi7qxftonjplmmdsbg14q[.]oastify[.]com:443 (a Burp Collaborator domain, a known penetration-testing exfiltration endpoint). The package has no legitimate functionality beyond this reconnaissance payload.
- analyzed by
- Leitwacht
- first seen
- Jun 20, 2026, 10:02 AM
- analyzed
- Jun 20, 2026, 10:02 AM
Related advisories
- oauth-connect@0.1.1
- backpack-ios@1.0.0
- log-taker1@0.1.0
- ts-bn-lint@3.1.19
- ts-bn-proto@5.8.1
- afterpay-sdk-example-server@1.2.1
- starship-timeline@1.0.1
- dbt-language-server@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.