vuln-package@99.9.9
Malicious code in vuln-package (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The postinstall hook (node index.js) collects the installer's username, hostname, and current working directory, then POSTs this system fingerprint as JSON to webhook[.]site/cde465c1-3853-40ea-880c-fdca6fe508cc. The package has no other functionality — it is a host-reconnaissance beacon that exfiltrates environment metadata to an external endpoint on install.
- analyzed by
- Leitwacht
- first seen
- Jul 12, 2026, 01:47 PM
- analyzed
- Jul 12, 2026, 01:47 PM
Related advisories
- @iana-rzms/bff-sdk@1.0.0
- cookie-sign@2.3.5
- babel-preset-lib-client@4.9.11
- google-caja-bower@20.20.20
- kuaishou@99.9.9
- trinity-scheme@20.0.0
- chai-as-doc@2.3.5
- @meziizana/frontend-logger@10.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.