poly-custom-api@5.3.1
Malicious code in poly-custom-api (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool TransferT1071.001 · Web Protocols
Analysis
poly-custom-api@5.3.1 is a remote-code-execution dropper. Its exported function fetches a payload from hxxps://46[.]183[.]25[.]232:45000/icons/108 (with custom HTTP header bearrtoken:logo) and executes the response body via new Function() with full Node.js context (require, module, process, Buffer, setTimeout, etc.), enabling arbitrary code execution on the victim machine. The package includes a decoy function that fetches from cdnjs[.]cloudflare[.]com to appear benign. The C2 server IP is 46[.]183[.]25[.]232:45000.
- analyzed by
- Leitwacht
- first seen
- Jul 21, 2026, 09:26 PM
- analyzed
- Jul 21, 2026, 09:30 PM
Related advisories
- alpha-helper@1.3.4
- tailwindcss-form-components@1.5.0
- async-mutex-hook@2.1.0
- chai-foundry@7.0.3
- rollup-plugin-polyfill-helper@1.0.1
- 1239i32049i@0.1.0
- faust-cont@1.0.0
- quickbuf@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.