style-class-utils@1.0.0
Malicious code in style-class-utils (npm)
Analysis
style-class-utils@1.0.0 is a trojanized utility package. The published index.js contains harmless color-conversion helpers, but the postinstall hook (postinstall.js) runs on install. It collects hostname, OS details, process tree, CI/CD environment variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, CI, RUNNER_NAME), cloud metadata (probes Tencent Cloud and AWS metadata endpoints), and the full environment (including NPM_TOKEN, GITHUB_TOKEN, AWS_* credentials). All collected data is base64-encoded and exfiltrated via HTTP GET to pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com/z?d={data}. The C2 domain is an OAST/Interactsh-style callback service.
- analyzed by
- Leitwacht
- first seen
- Jul 28, 2026, 08:09 AM
- analyzed
- Jul 28, 2026, 08:10 AM
Related advisories
- date-sanitize-helper@1.0.0
- data-format-helper@1.0.1
- color-convert-helper@1.0.0
- react-campaign-optimizer@1.0.0
- simple-date-formatter-new-7@1.0.0
- simple-date-formatter-new-6@1.0.0
- @adominadmininstr/fmt-date-helper@1.0.0
- @adominadmininstr/date-util-helper@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.