OpenSSF/OSV advisory MAL-2026-6123 confirms this npm version as malicious. On `require('@onum-releases/auth')`, index.js reads `os.hostname()` and issues an HTTP GET to `auth.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastify.com`, transmitting the installer's host identifier to a Burp Collaborator out-of-band domain via both DNS resolution and HTTP. The package.json self-identifies as a 'dependency-confusion / scope-takeover demonstration' placeholder under the @onum-releases scope, so...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @onum-releases/auth (npm)
Details
On `require('@onum-releases/auth')`, index.js reads `os.hostname()` and issues an HTTP GET to `auth.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastify.com`, transmitting the installer's host identifier to a Burp Collaborator out-of-band domain via both DNS resolution and HTTP. The package.json self-identifies as a 'dependency-confusion / scope-takeover demonstration' placeholder under the @onum-releases scope, so any build that mistakenly resolves an internal `@onum-releases/*` name to the public registry will leak its hostname to a third-party collaborator endpoint. Although labeled a PoC, the import-time beacon performs unconsented exfiltration of installer-side data to an attacker-controlled domain.
Decision reason
OpenSSF Malicious Packages via OSV confirms @onum-releases/auth@1.0.1 as malicious (MAL-2026-6123): Malicious code in @onum-releases/auth (npm)