Malicious code in catwrestlingbird (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0) [email protected] declares a `postinstall` script (`node install.js`) that automatically runs on `npm install`. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release, network interfaces, a depth-3 listing of the current working directory, selected environment variables, and the output of `ss`/`netstat`, `arp`/`ip neigh`, and `ip route`/`route` — and POSTs the JSON payload to a hardcoded plain-HTTP endpoint at `http://192.168.4.216:3000/api/beacon`. install.js then spawns heartbeat.js as a detached, unref'd child process so it survives beyond install. heartbeat.js long-polls the same C2 every 60 seconds; on a `shell` task it upgrades to a WebSocket at `/ws/shell/<beacon_id>/open`, spawns `/bin/sh`, pipes the shell's stdout/stderr back to the server as WebSocket frames, and writes inbound WebSocket frames into the shell's stdin — a fully remote-controlled interactive shell on the installer's host, gated only by a hardcoded `x-beacon-secret`. A `kill` response from the C2 rewrites the installer's package.json and package-lock.json to remove the package and recursively deletes the package directory, providing a remote self-destruct/anti-forensics path. A SHA-256 hashcash proof-of-work handshake against `/api/pow` gates the beacon. The package description is empty and no functionality is advertised to the installer.

Source published

21 Sep 2026 03:30:37 UTC

Source modified

21 Sep 2026 04:00:06 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.