LWA-2026-7152 confirmed malware
npm-wold@1.1.1
Malicious code in npm-wold (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool TransferT1071.001 · Web Protocols
Analysis
The package npm-wold@1.1.1 is a trojanized object-utility library. Its postinstall hook (dist/config.js) fetches a payload from my-api[.]trade-api[.]workers[.]dev?id=4 and dynamically executes the response using globalThis[data.success](data.id), enabling arbitrary remote code execution on the installer's machine at install time. The bundled flatten/path utility code is a decoy.
- analyzed by
- Leitwacht
- first seen
- Jul 27, 2026, 01:41 PM
- analyzed
- Jul 27, 2026, 01:42 PM
Related advisories
- animate-css-vite@1.0.1
- encrypt-string-safe@2.1.0
- dateuuidv2@1.0.0
- app-sim-layer@2.1.6
- app-node-layer@2.1.6
- chai-as-rendered@1.2.0
- @daylightqc/date-fmt-lite@1.1.2
- cors-version@1.0.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.