boardwalk-js-tests @1.1.1
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:00 AM UTC
OSV ID
MAL-2026-12062
Ecosystem
npm
Summary
package.json declares preinstall: node index.js . On npm install , index.js collects the installer's hostname, username, homedir, DNS server list, and current working directory, reads /etc/passwd and /etc/hosts, and POSTs the JSON payload over HTTPS to h8q14cqgn5ra8v0bjg70nqxsbjhc52tr.oastify.com — a Burp Collaborator (OAST) subdomain used as an attacker-controlled exfiltration callback. The package provides no advertised functionality; its sole install-time behavior is host reconnaissance and data exfiltration.
Source: amazon-inspector (aceb6d52ccfbb88b344c7edfe504516e6496f7886f95a8fec3b69c5127bd2924)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.