LWA-2026-7111 confirmed malware
@cybs_forus/test@1.0.0
Malicious code in @cybs_forus/test (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1071.004 · DNS
Analysis
The preinstall hook (preinstall.js) collects the hostname, username, and current working directory, hex-encodes them, and exfiltrates the data via a DNS lookup to the subdomain *.ajxrlezaywraiubilqrzxehaqdmbdu3me[.]oast[.]fun — a DNS-tunnel exfiltration technique. The package has no repository, no README, and no functional code beyond the exfiltration payload.
- analyzed by
- Leitwacht
- first seen
- Jul 24, 2026, 10:38 PM
- analyzed
- Jul 24, 2026, 10:40 PM
Related advisories
- @leviosa86com/leviosa86-test@6.0.0
- ap3-components-ui@9.999.0
- @uwr/colors@1.3.6
- wp-codebox-workspace@9999.99.99
- @dxcl/http-common-js@99.99.99
- @dxcl/fund-js@99.99.99
- @dxcl/user-js@99.99.99
- ug-env-switch-ball@7.9.9
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.