WP Beacon
Audit #53 Malicious Closed by wp.org
Show full summary
Verdict: malicious. On 2026-09-07, SVN r3684673 (instawp, message Update to version incident-14ypaj0acdw from GitHub) padded tailwind.config.js from ~2.2 KB to 9,794 bytes with a Node Ethereum-oracle C2 dropper. The padding looks up recent transactions from address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a via public ETH RPCs and Blockscout, XOR-decrypts a remote payload (X-Payload-B64), then evals and detached-spawns Node loaders at /0x/cls and /0x/ls. Same dropper family as npm malware MAL-2026-12217 (tailwind-animate-plugin).
The same commit also bumped Stable tag toward 0.1.3.9 and included a benign Sync (Beta) DB ordering fix — no tags/0.1.3.9 was ever published, so downloads.wordpress.org kept serving 0.1.3.8. Infected trunk was live for ~23 hours until r3686315 (2026-09-08 05:39 EDT) by @instawp: Remove accidental publish; restore stable 0.1.3.8. Stable downloads stayed on 0.1.3.8. On 2026-09-08, after Austin reported the malware to plugins@wordpress.org, the WordPress Plugins Team temporarily closed the listing pending a full review (~40,000 installs at close).
Most sites on the stable channel were not auto-updated into the payload. Risk is highest for anyone who pulled trunk during the window, or ran Node against tailwind.config.js (build/CI). PHP runtime of WordPress alone does not execute this dropper. Overnight Wordfence-on-diffs reported hits=0 — Node/build-config payloads are outside typical PHP malware scanners.
2026-09-08 update: Austin reported to plugins@wordpress.org; Plugins Team closed the listing as of 2026-09-08 (temporary, pending full review). Stable downloads had stayed on 0.1.3.8. Watching for reopen / clean restore.
Site owners should remediate immediately. Plugin author: see the steps below to clear this label.
If you run instawp-connect on your site
Verify your install matches the wp.org canonical version:
wp plugin verify-checksums instawp-connectA patched build isn't yet published for this audit. Check the security advisories index or remove the plugin until one is available.
Or remove the plugin entirely:
wp plugin deactivate instawp-connect
wp plugin delete instawp-connectPlugins under the same committer's SVN access
instawp holds push access to 3 plugins totalling 140k+ active installs. Each non-target plugin scans clean today but represents a one-commit hijack opportunity.
Audit — instawp-connect (InstaWP Connect)
- Plugin: instawp-connect (InstaWP Connect – 1-click WP Staging & Migration)
- Active installs: 40,000
- Author:
@instawp(InstaWP; member since 2022-07-06) - Plugin temporarily closed on wp.org as of 2026-09-08 (pending full review)
- Baseline (clean stable): 0.1.3.8 (r3643122 / Forgejo
8fe6391) - Infected head: version label incident-14ypaj0acdw / readme Stable 0.1.3.9 (never published as a downloads tag)
- Forgejo: https://plugin-repo.wpbeacon.io/wporg/instawp-connect
- Compare:
8fe6391...11b710c
Timeline
| When (America/New_York) | Event |
|---|---|
| 2026-08-12 05:38 | r3643122 — Update to version 0.1.3.8 from GitHub (clean) |
| 2026-09-07 06:38 | r3684673 — Update to version incident-14ypaj0acdw from GitHub by @instawp. Pads tailwind.config.js 2200→9794 bytes with ETH-oracle Node dropper; bumps Stable tag text to 0.1.3.9; benign Sync DB ORDER BY id DESC fix in includes/sync/class-instawp-sync-db.php |
| 2026-09-07 (catalog diff) | Beacon weekday catalog review flags sole IOC among 2026-09-07 diffs for this slug |
| Overnight Wordfence-on-diffs | hits=0 (Node/build-config not in PHP scan path) |
| 2026-09-08 05:39 | r3686315 — @instawp: Remove accidental publish; restore stable 0.1.3.8. Trunk tailwind.config.js back to 2200 bytes; Stable tag 0.1.3.8 |
| 2026-09-08 audit | downloads.wordpress.org still serves instawp-connect.0.1.3.8.zip (clean). Forgejo mirror HEAD still at infected 11b710c / 9794-byte file until next rebuild |
| 2026-09-08 (later) | Austin reported malware to plugins@wordpress.org; Plugins Team closed listing temporary pending full review. Stable channel had remained on 0.1.3.8 |
Malicious commit boundary
- Full hash:
11b710c4cd8eab490eda3cb84f5938981feee603 - Author:
instawp <instawp@users.noreply.wordpress.org> - Files touched:
tailwind.config.js(malicious),readme.txt(0.1.3.9 changelog),includes/sync/class-instawp-sync-db.php(benign)
Dropper mechanics (tailwind.config.js line 71)
Legitimate Tailwind module.exports block is closed, then tab-padding, then minified Node that:
1. Sets sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a. 2. Queries eth.blockscout.com account txlist API and public ETH RPC pool (1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io). 3. Decodes tx.to first 8 bytes as two IPv4s. 4. Fetches http://{ip}:443/0x/cls and /0x/ls with XOR keys; accepts body or X-Payload-B64 header. 5. Runs recovered JS in-process and via detached node -e child.
Campaign ID string in payload: global.i = 'A8-6369-1'.
On-chain C2 (read-only)
Blockscout txlist for the oracle address shows active ~3–4h cadence. Recent to values decode to 193.247.144.38 (as of 2026-09-08). Do not connect to those IPs; quoting chain data is sufficient.
Supply-chain review
- Malicious file: only tailwind.config.js
- No package.json; Node must load the config (CI/dev builds)
- PHP files (78 non-vendor): staging/migration helpers only; not this campaign
- Updates class: local schema migrations only
Sibling fan-out (author_slug=instawp)
| Slug | Installs | Same IOC |
|---|---|---|
| instawp-connect | 40,000 | YES (r3684673; reverted r3686315) |
| string-locator | 100,000 | clean |
| instamigrate | 20 | clean |
Among 2026-09-07 catalog diffs, this IOC appeared only in instawp-connect.
Hijack-indicator matrix
| Indicator | Result |
|---|---|
| Sole committer >=2y? | Yes — @instawp 212 commits since 2022-11-04 |
| Sudden new committer before inject? | No — inject and revert both @instawp |
| Author profile drift? | No — InstaWP profile since 2022-07-06 |
| Code-level malware? | Yes — ETH-oracle Node dropper in tailwind.config.js |
| Outbound C2 / known bad? | Yes — oracle above; live IP 193.247.144.38; family MAL-2026-12217 |
| New SVN credentials before inject? | No |
Compromise vs intentional
More likely compromised publish path / developer workstation than intentional vendor malice. Reasons: same family as MAL-2026-12217; mixed into Sync bugfix under incident-* label; next-morning accidental-publish revert; long-running vendor history. Attributed to @instawp because that identity signed the SVN revision.
Comparable cases
See MAL-2026-12217, audit 12, audits 28/45-48.
Detection gap
Overnight diffs scanner: 0 hits on this Node build-config pad.
2026-09-08 — wp.org temporary close
Austin reported the malware to plugins@wordpress.org. The WordPress Plugins Team closed the plugin listing as of 2026-09-08, marked temporary / pending a full review. Stable downloads had stayed on 0.1.3.8 throughout; no clean reopen yet. Watching for reopen or a clean tagged restore before flipping cleanup_status beyond closed_by_wporg.