MAL-2026-15549

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9373ed3aa6afb53ef5d5d3dd4860a4ed9e7b151fdd8c5c7782f2b2e914810fc7)

Unscoped npm package ckeditor5-ckbox mimics the legitimate @ckeditor/ckeditor5-ckbox plugin. package.json declares a preinstall hook (node index.js) that runs on npm install. index.js collects installer machine identifiers — os.hostname(), os.userInfo() (username, uid, gid, shell), platform/arch, home directory, cwd, and the output of whoami and id executed via child_process — and POSTs the JSON to the hardcoded Burp Collaborator OAST domain https://shdu19bid9mc4e6lezjmldk0erki88wx.oastify.com/system-info. The package contains no CKEditor functionality; the sole payload is the install-time beacon. Author/description are empty and the name is a typosquat of the scoped legitimate package.