nemo-jaws@99.99.9
Vulnerability report · Last retrieved from osv.dev September 6, 2026 at 4:01 AM UTC
OSV ID
MAL-2026-2785
Ecosystem
npm
Summary
On npm install, the package's preinstall hook executes index.js, which collects host identifiers (os.hostname(), os.platform(), os.arch(), os.homedir(), and configured DNS servers via dns.getServers()) and POSTs them to a hardcoded Burp Collaborator subdomain at iaw5sqvrkqmghau6kwlwtalpqgw8k88x.oastify.com/hit. The destination is an out-of-band interaction endpoint controlled by an external party, not a first-party service of the package.
Source: amazon-inspector (a52b0aca2f522f9d9ab39b1b2ddf4f16b0e2d5c40b796392848c3a3ac77e73fa)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.