@leviosa86com/leviosa86-test@6.0.0
Malicious code in @leviosa86com/leviosa86-test (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1071.004 · DNS
Analysis
The preinstall hook (node src/index.js) executes src/poc/index.js, which collects the hostname, current working directory, username, and external IP address (via ifconfig[.]me), then exfiltrates this data via a DNS lookup to d9bd62bu6g119svvav70o3p9tymtrxkoj[.]oast[.]site. The package has no legitimate functionality — it is a single 406-byte exfiltration payload.
- analyzed by
- Leitwacht
- first seen
- Jul 15, 2026, 01:53 AM
- analyzed
- Jul 15, 2026, 01:53 AM
Related advisories
- ap3-components-ui@9.999.0
- @uwr/colors@1.3.6
- wp-codebox-workspace@9999.99.99
- @dxcl/http-common-js@99.99.99
- @dxcl/fund-js@99.99.99
- @dxcl/user-js@99.99.99
- ug-env-switch-ball@7.9.9
- tdhg-demp@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.