Instawp

1 linked audits · 0 IOCs catalogued · 40k+ headline-plugin installs · first seen 2026-09-07 · last activity 2026-09-08

Audits in this campaign

Cleaned

Audit #53 InstaWP Connect – 1-click WP Staging & Migration — 40k+ installs

Verdict: malicious. On 2026-09-07, SVN r3684673 (instawp, message Update to version incident-14ypaj0acdw from GitHub) padded tailwind.config.js from ~2.2 KB to 9,794 bytes with a Node Ethereum-oracle C2 dropper. The padding looks up recent…

baseline 0.1.3.8 → head incident-14ypaj0acdw 6d ago