forge-extended@1.0.1
Malicious code in forge-extended (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
The package runs a preinstall hook (node index.js) that collects system information from the installer's machine — hostname, username, home directory, DNS server addresses, /etc/passwd contents, and /etc/hosts contents — and exfiltrates them via HTTPS POST to oastify[.]com (Burp Collaborator). The C2 endpoint is 67bqctsh977zz60hiszvr1pbc2iu6ku9[.]oastify[.]com.
- analyzed by
- Leitwacht
- first seen
- Jul 22, 2026, 06:26 PM
- analyzed
- Jul 22, 2026, 06:26 PM
Related advisories
- knowledge-grader@1.0.1
- chai-as-stringify@7.0.2
- xerohub-discord-voice-v2@1.8.0
- chai-as-format@2.3.5
- chai-as-deployer@2.3.6
- chai-foundry@7.0.3
- quickbuf@1.0.1
- app-data-ist@2.1.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.