@onereach/slack-helpers@1.0.5
Malicious code in @onereach/slack-helpers (npm)
Analysis
The package's preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime and executes a heavily-obfuscated 727KB bundle (math_init.js) at install time. The obfuscated payload performs host fingerprinting and DNS-tunnel exfiltration: it issues DNS TXT queries to a sinkholed C2 domain (_leitwacht.attached.local.) to exfiltrate host identity data, and fetches remote content that is eval-executed (remote-code-execution dropper). The payload also delays execution past the analysis window and evades sandbox detection. Installing this package runs the payload automatically before any dependency is used.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 11:59 AM
- analyzed
- Aug 4, 2026, 02:43 PM
Related advisories
- @onereach/ui-components@27.0.4
- @onereach/ui-components-vue2@27.0.4
- @onereach/expression-components@9.1.3
- @digiptf/common@99.99.99
- hunsterx-package@7.0.1
- search-from-feed@999.0.0
- @dxcl/indicators-js@99.99.99
- @dxcl/transaction-js@99.99.99
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.