wp-codebox-workspace@9999.99.99
Malicious code in wp-codebox-workspace (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1071.004 · DNST1041 · Exfiltration Over C2 Channel
Analysis
Packaged as a version-squat (version 9999.99.99) with a postinstall hook that runs postinstall.js. The hook fingerprints the install environment — host OS, Node.js version, CI/CD provider, GitHub repository/owner/workflow — and exfiltrates this metadata to ddactic-lab[.]online/sc/beacon via HTTPS POST. A DNS-based fallback channel encodes package and CI data into subdomain queries against *.b[.]ddactic-lab[.]online to bypass HTTP-only proxies. index.js is a stub with no real functionality; the entire package exists only to install and beacon.
- analyzed by
- Leitwacht
- first seen
- Jun 25, 2026, 06:59 AM
- analyzed
- Jun 25, 2026, 07:00 AM
Related advisories
- @dxcl/http-common-js@99.99.99
- @dxcl/fund-js@99.99.99
- @dxcl/user-js@99.99.99
- ug-env-switch-ball@7.9.9
- tdhg-demp@1.0.0
- sftc-advance-components@0.9.9
- rtms-manager@1.0.0
- reseller-app@9.9.11
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.