store-locator-widget@9999.0.0
Malicious code in store-locator-widget (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 Channel
Analysis
The preinstall hook (node callback.js) collects the hostname, username, current working directory, npm registry URL, and CI/CD environment variables (GitHub, GitLab, Bitbucket, Travis, Drone, Buildkite, CircleCI, Jenkins identifiers) and sends them via HTTP GET to 75[.]119[.]137[.]232:31337/depconfuse. This is a dependency-confusion recon beacon that profiles the install environment to identify high-value CI/CD targets for follow-on supply-chain attacks.
- analyzed by
- Leitwacht
- first seen
- Aug 2, 2026, 07:34 PM
- analyzed
- Aug 2, 2026, 07:36 PM
Related advisories
- sc-geeksquad-core@9999.0.0
- sc-payment-utils@9999.0.0
- jquery.ui.core@9999.0.0
- jquery.ui.tabs@9999.0.0
- sc-font-icons@9999.0.0
- break-after@9999.0.0
- dust-helpers@9999.0.0
- widget-forge@9999.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.