bulk-add-sdk@1.99.99
Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 7:43 AM UTC
OSV ID
MAL-2026-16325
Ecosystem
npm
Summary
Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects hostname, platform, arch, cwd, and the machine's public IP (obtained by shelling out via execSync to curl -s ifconfig.me || wget...) and transmits the data to a hardcoded subdomain of wallclip.me over two channels: an HTTPS POST via https.request with rejectUnauthorized: false (disabling certificate verification), and a DNS lookup against a beacon of the form ${project_id}.${safeHost}.[...].wallclip.me so a passive DNS observer receives the hostname and project identifier even when outbound TCP/443 is blocked. The package main entry is a stub with no library functionality, so the install-time beacon is the package's sole effect. The package name resembles a legitimate SDK but ships only a reconnaissance beacon targeting a non-first-party domain.
Source: amazon-inspector (b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.