tidal-embed-player@1.0.1
Malicious code in tidal-embed-player (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The package's preinstall hook runs index.js, which collects system information (hostname, home directory, username, DNS server list, /etc/passwd contents, /etc/hosts contents, and the package.json metadata) and sends it via HTTPS POST to 1rtlwocct2ruj1kc2njqbw96wx2qqhe6[.]oastify[.]com — a Burp Collaborator exfiltration endpoint. The package has no repository, no description, and no functionality beyond this data theft.
- analyzed by
- Leitwacht
- first seen
- Jul 22, 2026, 06:57 PM
- analyzed
- Jul 22, 2026, 06:57 PM
Related advisories
- forge-extended@1.0.1
- knowledge-grader@1.0.1
- chai-as-stringify@7.0.2
- xerohub-discord-voice-v2@1.8.0
- chai-as-format@2.3.5
- chai-as-deployer@2.3.6
- chai-foundry@7.0.3
- quickbuf@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.