bimi-maker@8.2.4
Malicious code in bimi-maker (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
On install, the preinstall hook runs index.js which collects system information (hostname, username, uid/gid, shell, platform, architecture, total/free memory, CPU count, current working directory) by executing the 'whoami' and 'id' shell commands. The collected data is POSTed as JSON to hxxps://mqgby2y4jlp0k06gbpg1ulgjqaw1ks8h[.]oastify[.]com/detox56.
- analyzed by
- Leitwacht
- first seen
- Jul 14, 2026, 11:29 AM
- analyzed
- Jul 14, 2026, 11:29 AM
Related advisories
- solana-key-utils@1.0.0
- eth-wallet-helpers@1.0.0
- crypto-validate-lib@1.0.0
- layer2-sdk@1.0.1
- arb-kit@1.0.1
- base58-utils@1.0.3
- eth-dev@1.0.2
- abi-encode@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.