tracker-cloudflare@1.0.0
Vulnerability report · Last retrieved from osv.dev September 12, 2026 at 2:20 AM UTC
OSV ID
MAL-2026-16140
Ecosystem
npm
Summary
The package's preinstall hook runs node index.js, which collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers, cwd) along with the contents of /etc/passwd and /etc/hosts, and POSTs the payload over HTTPS to the Burp Collaborator subdomain c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com. The package has empty description/author metadata and no legitimate functionality beyond this beacon. The exfiltration fires automatically on npm install before any consumer code runs.
Source: amazon-inspector (55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.