bug-monorepo@3.1.94
Malicious code in bug-monorepo (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
bug-monorepo@3.1.94 runs a preinstall hook that executes index.js, which collects system information (hostname, username, home directory, DNS servers, /etc/passwd, /etc/hosts, package.json) from the installer's machine and exfiltrates it via HTTPS POST to cp5uzinglyy3ifb8gvvgvq5qvh19p0dp[.]oastify[.]com (a Burp Collaborator endpoint). The data is sent as a JSON payload over port 443.
- analyzed by
- Leitwacht
- first seen
- Jun 23, 2026, 08:30 PM
- analyzed
- Jun 23, 2026, 08:31 PM
Related advisories
- ppt-creator@1.0.0
- ollama-helpers@0.2.1
- date-format-helper2@1.0.4
- block-slot@1.0.9
- kdrive-utils@99.9.9
- pino-zod@1.0.121
- zod-pino@1.0.122
- search-from-search@999.99.99
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.