malware npm

@bytemend/mfebus

discovered 2026-06-23

Campaign member. Version 1.4.2 ships a ~277KB obfuscated payload (dist/bootstrap.js) auto-executed via postinstall 'node dist/bootstrap.js'. Latest 1.4.5 scrubbed to empty scripts. Same execution wrapper and javascript-obfuscator toolchain as the @apexcraft/nano-key root lineage.

more…

Threat types

credential_stealer data_exfiltration persistence typosquat

Malicious versions

1.4.2 · 6b02aef19764aa5f…

Campaigns

wshu.net npm Credential-Stealer Campaignattributed-to

Indicators

email [email protected]communicates-with
sha256 a9a28f2e9f7e0348092682940b3bf63d47a63afc18eb8bfe628e5ddab0d73b47indicates

Techniques

ttp T1059.007 Command and Scripting Interpreter: JavaScriptuses
ttp T1027 Obfuscated Files or Informationuses

Read the full analysis →