bjm-low-code-components @99.0.0
Vulnerability report · Last retrieved from osv.dev August 12, 2026 at 3:23 AM UTC
OSV ID
MAL-2026-13751
Ecosystem
npm
Summary
On npm install, the package's postinstall hook runs canary.js, which collects the installer's hostname, username, current working directory, and selected environment variables and POSTs them over plain HTTP to a hardcoded Burp Collaborator OAST subdomain at 2pslbvbc3adfni1pbe9xy2b1asgj4cs1.oastify.com/bjm-canary. This is a dependency-confusion / reconnaissance beacon: installer-side identity and environment data leave the machine automatically on install to an attacker-controlled endpoint.
Source: amazon-inspector (f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.