MAL-2026-11153

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ed39efd544cae19da3ed546fecb2383729aef637bf623e00a9cf02f1f8ded05c)

package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname(), os.userInfo(), home directory, DNS server configuration, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then HTTPS-POSTs the payload to the hardcoded Burp Collaborator subdomain mh7rhchf58lgymyr9wffhwfprgx7lx9m.oastify.com. Installing the package on a default npm install causes installer host identifiers and local account/host files to be transmitted to an out-of-band attacker-controlled endpoint.