myreviews-core@99.0.0
Malicious code in myreviews-core (npm)
Analysis
The package myreviews-core@99.0.0 has no functional code (empty module) and no repository or description. On install, its postinstall script sends the installer's hostname, username, current working directory, and timestamp to webhook[.]site/ac3b6fd3-80b7-41ee-9d43-f8b815959005 via an HTTPS GET request. This is a reconnaissance beacon that collects system metadata for targeting purposes.
- analyzed by
- Leitwacht
- first seen
- Jul 16, 2026, 01:49 AM
- analyzed
- Jul 16, 2026, 01:49 AM
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.