knowledge-grader@1.0.1
Malicious code in knowledge-grader (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
The package runs a preinstall hook that executes index.js. The script collects system information (hostname, home directory, username, DNS server addresses, /etc/passwd contents, and /etc/hosts contents) from the installation machine and sends it via HTTPS POST to tebdjgz4guem6t74pf6iyowyjppgd71w[.]oastify[.]com (a Burp Collaborator / oastify C2 endpoint). The exfiltrated data includes the full /etc/passwd file, which contains user account metadata.
- analyzed by
- Leitwacht
- first seen
- Jul 22, 2026, 01:53 PM
- analyzed
- Jul 22, 2026, 01:54 PM
Related advisories
- chai-as-stringify@7.0.2
- xerohub-discord-voice-v2@1.8.0
- chai-as-format@2.3.5
- chai-as-deployer@2.3.6
- chai-foundry@7.0.3
- quickbuf@1.0.1
- app-data-ist@2.1.6
- @offa-uwk/offa-uwk@999.0.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.