bugexploit@99.9.9
Malicious code in bugexploit (npm)
T1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1071.001 · Web ProtocolsT1059.007 · JavaScript
Analysis
On install, the postinstall hook runs index.js which collects the installer's username, current working directory, and hostname, then POSTs this data as JSON to hxxps://webhook[.]site/cd23dfb8-a0fc-4ff7-818c-f7812fcb4bec. The package has no other functionality, no repository, and no description.
- analyzed by
- Leitwacht
- first seen
- Jul 12, 2026, 07:59 PM
- analyzed
- Jul 12, 2026, 07:59 PM
Related advisories
- vuln-package@99.9.9
- @iana-rzms/bff-sdk@1.0.0
- cookie-sign@2.3.5
- babel-preset-lib-client@4.9.11
- google-caja-bower@20.20.20
- kuaishou@99.9.9
- trinity-scheme@20.0.0
- chai-as-doc@2.3.5
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.