tol8t

GHSA-69x6-h25v-58j2

Malicious code in tol8t (npm)

Details

**Severity:** Critical

**Affected versions:** `= 14.0.0`

## Source: amazon-inspector (c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27)
package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at https://discord.com/api/webhooks/1413937656697720862/. The preinstall hook sends the installer's current working directory ($(pwd)) and the postinstall hook sends the machine hostname ($(hostname)). Both fire automatically during `npm install` with no user interaction. The package ships no other functionality; its sole behavior is host reconnaissance beaconing to an attacker-controlled Discord webhook.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/tol8t/MAL-2026-16218.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/tol8t/MAL-2026-16218.json
- https://www.npmjs.com/package/tol8t/v/14.0.0
- https://github.com/ossf/malicious-packages/blob/11df7a623d9d52f0c3bcd95c766041857268479c/osv/malicious/npm/tol8t/MAL-2026-16218.json
- https://github.com/advisories/GHSA-69x6-h25v-58j2

Compromised versions (1)

= 14.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.