wolverinechat@1.0.1
Malicious code in wolverinechat (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The package runs a preinstall hook that executes index.js before installation completes. The script reads /etc/passwd, /etc/hosts, the system hostname, home directory, username, DNS server configuration, and the package.json metadata, then sends all of this data via HTTPS POST to 7ckdbwo9f8dtrg8y36sbe4e8lzrqfg35[.]oastify[.]com (a Burp Collaborator endpoint) on port 443.
- analyzed by
- Leitwacht
- first seen
- Jul 28, 2026, 06:39 PM
- analyzed
- Jul 28, 2026, 06:40 PM
Related advisories
- blots@2.1.0
- voicemail@1.0.1
- toll_free@1.0.1
- @adominadmininstr/fmt-date-helper@1.0.0
- @adominadmininstr/date-util-helper@1.0.0
- array-sort-helper@1.0.0
- json-to-table-util@1.0.0
- style-class-utils@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.