exiouss

MAL-2026-17327

Malicious code in exiouss (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (43ce408818d0222061c3b6ed499d77a245aae78e30e4f57c8e6e77ee52705805)
main.js in [email protected] imports child_process and issues POST requests to hardcoded endpoints, including https://gemini.google.com and https://ipc.shadxino.internal (main.js around lines 368-386). The presence of an `ipc.shadxino.internal` destination alongside a public Google host, combined with child_process usage and repeated `ping` invocations across the file (lines 202, 340, 420, 583, 611), fits an active-exfiltration/reconnaissance shape rather than any documented HTTP-client behavior. The `.internal` host is not a resolvable public destination and its appearance in a published npm module is consistent with an attacker-side collector or a leaked internal C2 name.

Compromised versions (1)

5.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.