Malicious code in monogrok (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3369fb16804682addfec56904223d0255c2a0ca6d35481e744221e8252f2000d) Package publishes as a generic 'M!T' library with an unrelated Apache-license README, but the tarball contains an offensive spam / phishing / mailbox-cracking toolkit: SMTP credential brute-force and AWS SES abuse (`func/smx/aws.js`, `func/smx/awssho.js`), IMAP/POP3/EWS/MS-OAuth mailbox checkers (`func/box/{imap,pop3,ewsv,msap,caut}.js`), phishing redirector chain (`func/rdt/*`), SOCKS/HTTP proxy rotation (`func/ipr/*`), and bulk-mailer 'zombie' senders (`func/snd/mlr/{prxml,zmbvf,zmrml}.js`). On load of the main entry `oibWljdTg.js`, `installLicenseGuard()` runs and — on integrity check — POSTs `os.hostname()`, `os.userInfo().username`, `process.cwd()`, PID, timestamp, and a bearer token read from `~/.monotomic.token` to a hardcoded author endpoint at `https://api.mntmc.rip/ibW9B3RlbmF/token/security/tamper`. `func/box/chrm.js` locates the installer's Chrome `User Data` directory (Windows `LOCALAPPDATA\Google\Chrome`, macOS `~/Library/Application Support/Google/Chrome`, Linux `~/.config/google-chrome`), launches puppeteer with `--user-data-dir=<profile>` + `--profile-directory=Default`, navigates to Outlook/Gmail URLs, and returns live session cookies (including httpOnly/secure). All 300+ source files are obfuscated with javascript-obfuscator (RC4/base64 rotated string arrays, control-flow flattening) to conceal the above behavior. `dependencies['node-ews']` is set to `github:oonlyjs/node-ews` — an unpinned mutable-branch reference under the same author account, resolved at each install, allowing arbitrary transitive code injection outside npm's tarball. Installing this package places offensive mail-abuse infrastructure on the machine, exfiltrates host identifiers and a stored bearer token to an author-controlled host on load, harvests the installer's browser session cookies, and pulls a mutable third-party dependency at install time. ## Source: ghsa-malware (d5c1f66e8c5e2e97b3fc1b3d8819b405e9187fc5fdd2cedc0882e018e2da56bd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The monogrok npm package masquerades as a generic MIT-licensed library but contains a hidden spam, phishing, and mailbox-cracking toolkit. On loading its main entry point, it sends host information and a bearer token to a hardcoded attacker endpoint. It also accesses the installer's Chrome user data directory to extract live session cookies from Outlook and Gmail sessions via puppeteer automation. Additionally, it depends on an unpinned mutable branch of a third-party library, enabling arbitrary transitive code injection during installation. The entire codebase is obfuscated to evade detection. This malicious behavior effectively compromises host credentials, session cookies, and enables mail abuse operations.
Potential Impact
Installation of affected monogrok versions results in exfiltration of sensitive host information and bearer tokens, theft of live browser session cookies including secure and httpOnly cookies, and deployment of mail abuse tools capable of SMTP credential brute forcing, mailbox checking, phishing redirects, proxy rotation, and bulk mailing. The use of a mutable third-party dependency further increases risk by allowing arbitrary code execution during installation. This compromises user credentials, privacy, and system integrity.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately uninstall affected versions (=1.0.30, =1.0.33) of monogrok and avoid installing this package. Audit systems for signs of compromise related to mail abuse and credential theft. Monitor for unauthorized network connections to the indicated attacker endpoint. Since this is a malicious package, rely on trusted sources and verify package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Malicious code in monogrok (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3369fb16804682addfec56904223d0255c2a0ca6d35481e744221e8252f2000d) Package publishes as a generic 'M!T' library with an unrelated Apache-license README, but the tarball contains an offensive spam / phishing / mailbox-cracking toolkit: SMTP credential brute-force and AWS SES abuse (`func/smx/aws.js`, `func/smx/awssho.js`), IMAP/POP3/EWS/MS-OAuth mailbox checkers (`func/box/{imap,pop3,ewsv,msap,caut}.js`), phishing redirector chain (`func/rdt/*`), SOCKS/HTTP proxy rotation (`func/ipr/*`), and bulk-mailer 'zombie' senders (`func/snd/mlr/{prxml,zmbvf,zmrml}.js`). On load of the main entry `oibWljdTg.js`, `installLicenseGuard()` runs and — on integrity check — POSTs `os.hostname()`, `os.userInfo().username`, `process.cwd()`, PID, timestamp, and a bearer token read from `~/.monotomic.token` to a hardcoded author endpoint at `https://api.mntmc.rip/ibW9B3RlbmF/token/security/tamper`. `func/box/chrm.js` locates the installer's Chrome `User Data` directory (Windows `LOCALAPPDATA\Google\Chrome`, macOS `~/Library/Application Support/Google/Chrome`, Linux `~/.config/google-chrome`), launches puppeteer with `--user-data-dir=<profile>` + `--profile-directory=Default`, navigates to Outlook/Gmail URLs, and returns live session cookies (including httpOnly/secure). All 300+ source files are obfuscated with javascript-obfuscator (RC4/base64 rotated string arrays, control-flow flattening) to conceal the above behavior. `dependencies['node-ews']` is set to `github:oonlyjs/node-ews` — an unpinned mutable-branch reference under the same author account, resolved at each install, allowing arbitrary transitive code injection outside npm's tarball. Installing this package places offensive mail-abuse infrastructure on the machine, exfiltrates host identifiers and a stored bearer token to an author-controlled host on load, harvests the installer's browser session cookies, and pulls a mutable third-party dependency at install time. ## Source: ghsa-malware (d5c1f66e8c5e2e97b3fc1b3d8819b405e9187fc5fdd2cedc0882e018e2da56bd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The monogrok npm package masquerades as a generic MIT-licensed library but contains a hidden spam, phishing, and mailbox-cracking toolkit. On loading its main entry point, it sends host information and a bearer token to a hardcoded attacker endpoint. It also accesses the installer's Chrome user data directory to extract live session cookies from Outlook and Gmail sessions via puppeteer automation. Additionally, it depends on an unpinned mutable branch of a third-party library, enabling arbitrary transitive code injection during installation. The entire codebase is obfuscated to evade detection. This malicious behavior effectively compromises host credentials, session cookies, and enables mail abuse operations.
Potential Impact
Installation of affected monogrok versions results in exfiltration of sensitive host information and bearer tokens, theft of live browser session cookies including secure and httpOnly cookies, and deployment of mail abuse tools capable of SMTP credential brute forcing, mailbox checking, phishing redirects, proxy rotation, and bulk mailing. The use of a mutable third-party dependency further increases risk by allowing arbitrary code execution during installation. This compromises user credentials, privacy, and system integrity.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately uninstall affected versions (=1.0.30, =1.0.33) of monogrok and avoid installing this package. Audit systems for signs of compromise related to mail abuse and credential theft. Monitor for unauthorized network connections to the indicated attacker endpoint. Since this is a malicious package, rely on trusted sources and verify package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10638
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a577ef668715ace43b41c59
Added to database: 07/15/2026, 12:37:10 UTC
Last enriched: 07/15/2026, 12:57:40 UTC
Last updated: 07/30/2026, 00:26:15 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.