test89078-auth@99.99.99
Vulnerability report · Last retrieved from osv.dev September 18, 2026 at 2:37 AM UTC
OSV ID
MAL-2026-16271
Ecosystem
npm
Summary
The package's preinstall script (scripts.preinstall = 'node index.js') runs automatically on npm install and collects os.userInfo().username and os.hostname(), then issues a dns.lookup against a subdomain of 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site with the username and hostname embedded in the queried label. This is a DNS-based exfiltration beacon: installing the package transmits installer host identifiers to a non-first-party canary domain over DNS resolution at install time. The version number 99.99.99 and package name shape are consistent with a dependency-confusion lure targeting an internal package name.
Source: amazon-inspector (c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.