idlive-document-capture-web@14.2.1
Malicious code in idlive-document-capture-web (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
The package idlive-document-capture-web@14.2.1 is a combosquat of a real document-capture SDK name. Its preinstall hook runs index.js, which collects extensive system information (hostname, platform, architecture, home directory, username, uid/gid, shell, OS type/release, total/free memory, CPU count, whoami, id, current working directory) and exfiltrates it as a JSON POST to hxxps://koc9471aou79yxauab6in903uu0locc1[.]oastify[.]com/detox56. The C2 endpoint is hosted on oastify[.]com, an interactive testing/exfiltration sink service.
- analyzed by
- Leitwacht
- first seen
- Jul 15, 2026, 03:17 PM
- analyzed
- Jul 15, 2026, 03:18 PM
Related advisories
- formatters.ts@14.2.1
- ac-raf-emitter@3.0.1
- @leviosa86com/leviosa86-test@6.0.0
- @debile/require-dir@1.9.1
- @web3-helpers/core@1.0.5
- smb-common-uikit@15.2.0
- ahooks-3.7.8@13.1.1
- cppt-common@13.1.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.