CERT24MAL-2026-17808 — Malicious code in @s4yhiitestpoc/r2-https-b (npm)Loading data…
CERT24Threat Observatory
Period

MAL-2026-17808 — Malicious code in @s4yhiitestpoc/r2-https-b (npm)

The postinstall.js script in @s4yhiitestpoc/r2-https-b automatically collects installer host and internal-infrastructure identification data during npm installation and sends it to an author-controlled endpoint.

← Back to intelligence

MAL-2026-17808 — Malicious code in @s4yhiitestpoc/r2-https-b (npm)

The postinstall.js script in @s4yhiitestpoc/r2-https-b automatically collects installer host and internal-infrastructure identification data during npm installation and sends it to an author-controlled endpoint.