json-to-table-util@1.0.0
Malicious code in json-to-table-util (npm)
Analysis
The package's postinstall hook runs postinstall.js, which collects extensive system and environment information — hostname, username, working directory, OS/kernel, container detection, process tree, GitHub CI variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, CI, RUNNER_NAME), IP addresses, DNS servers, cloud metadata probe results (Tencent Cloud and AWS), and the full environment (capturing any tokens, API keys, or credentials). All collected data is base64-encoded and exfiltrated via HTTP GET to pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com. The package's index.js is a decoy containing harmless color-utility functions.
- analyzed by
- Leitwacht
- first seen
- Jul 28, 2026, 08:09 AM
- analyzed
- Jul 28, 2026, 08:10 AM
Related advisories
- text-line-parser@1.0.0
- shift-sdk-v5@5.0.1
- simple-date-formatter-util-14@1.0.0
- api-node-sdk@2.1.6
- app-svm-layer@2.1.6
- @daylightqc/date-fmt-lite@1.1.2
- habingeer@2.1.6
- application-util@2.1.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.