wxwxtt

Details

wxwxtt is a dependency-confusion package (versions up to 99.0.1) from the same campaign as troubleshooting (MAL-2026-17641): a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to the troubleshooting payload (sha256 a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d), does the same when imported.

Compromised versions (10)

• 0.0.0
• 0.0.1
• 0.1.0
• 1.0.0
• 1.0.1
• 1.1.0
• 2.0.0
• 2.0.1
• 3.0.0
• 99.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.